v2: split session DB into inbound/outbound for write isolation

Eliminates SQLite write contention across the host-container mount
boundary by splitting the single session.db into two files, each with
exactly one writer:

  inbound.db  — host writes (messages_in, delivered tracking)
  outbound.db — container writes (messages_out, processing_ack)

Key changes:
- Host uses even seq numbers, container uses odd (collision-free)
- Container heartbeat via file touch instead of DB UPDATE
- Scheduling MCP tools now emit system actions via messages_out
  (host applies them to inbound.db during delivery)
- Host sweep reads processing_ack + heartbeat file for stale detection
- OneCLI ensureAgent() call added (was missing from v2, caused
  applyContainerConfig to reject unknown agent identifiers)

Verified: tsc clean, 327 tests pass, real e2e through Docker works.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

container/agent-runner/src/db/index.ts

@@ -1,5 +1,13 @@
-export { getSessionDb, initTestSessionDb, closeSessionDb } from './connection.js';
+export {
+  getInboundDb,
+  getOutboundDb,
+  getSessionDb,
+  initTestSessionDb,
+  closeSessionDb,
+  touchHeartbeat,
+  clearStaleProcessingAcks,
+} from './connection.js';
 export { getPendingMessages, markProcessing, markCompleted, markFailed, getMessageIn, findQuestionResponse } from './messages-in.js';
 export type { MessageInRow } from './messages-in.js';
-export { writeMessageOut, getUndeliveredMessages, markDelivered } from './messages-out.js';
+export { writeMessageOut, getUndeliveredMessages } from './messages-out.js';
 export type { MessageOutRow, WriteMessageOut } from './messages-out.js';