fix(FN-7952): establish PostgreSQL core authority (#2108)

## Summary

Fusion’s core runtime now treats PostgreSQL as the authoritative
metadata store without leaving current CLI, dashboard, desktop, or
engine composition roots uncompilable between stack layers. This is the
99-file foundation for the larger cutover: subsequent PRs migrate the
remaining consumers, plugins, and operator surfaces.

## Design decisions

- Runtime store construction fails closed when an asynchronous
PostgreSQL layer is unavailable; SQLite remains readable only at
explicit migration and identity-recovery boundaries.
- Project ownership is enforced across active, archived, workflow,
mission, analytics, and plugin-schema data.
- The small set of cross-package files in this layer are
compatibility-critical call sites required for a green intermediate
commit, not the complete consumer migration.
- Schema migration 0008 remains assigned to session-advisor state from
current `main`; mission lineage idempotency advances to 0009 so neither
invariant can be skipped.

## Validation

- All affected package typechecks pass: Core, Engine, Dashboard, CLI,
and Desktop.
- `pnpm test:gate` passes: 478 tests across the engine gate, PostgreSQL
core gate, and CLI workflow shape.
- The PR changes exactly 99 files.

## Stack

This is the base PR. Engine/dashboard, CLI/desktop/ops, plugins, and
docs/release follow as stacked PRs, each below 100 changed files.

Related: #2105


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* PostgreSQL is now the standard runtime backend, with embedded
PostgreSQL enabled by default.
* Added project-scoped storage for tasks, archives, chat sessions,
missions, knowledge pages, and operational data.
* Improved archived-task search, filtering, pagination, and restoration.
* Added safer plugin schema initialization with validation and project
isolation.
* Added PostgreSQL-backed workflow, mission, validator, and dashboard
capabilities.

* **Bug Fixes**
  * Improved startup timeout cancellation and resource cleanup.
* Prevented cross-project data access and phantom reservation cleanup
errors.
* Ensured archived tasks remain read-only and asynchronous writes
complete reliably.
  * Retired SQLite opt-out settings with clear startup errors.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/engine/src/cli-agent/runtime.ts

@@ -7,8 +7,8 @@
  * factory is the single place that actually instantiates the live bundle and
  * stitches the seams:
  *
- * - Builds a {@link CliSessionStore} over the project's EXISTING core Database
- *   (never opens a second connection — the store is a thin query layer).
+ * - Builds a {@link CliSessionStore} over the project's existing PostgreSQL
+ *   data layer (never opens a second connection).
  * - Registers all bundled adapters into a fresh {@link CliAdapterRegistry} (a
  *   per-runtime registry, NOT the process-wide `defaultCliAdapterRegistry`, so
  *   multi-project boots never collide on duplicate-registration).
@@ -25,7 +25,7 @@
  */
 
 import { CliSessionStore } from "@fusion/core";
-import type { Database } from "@fusion/core";
+import type { AsyncDataLayer } from "@fusion/core";
 import { CliAdapterRegistry } from "./adapter.js";
 import { BUNDLED_CLI_ADAPTERS } from "./adapters/index.js";
 import { CliSessionManager, type CliSessionManagerOptions } from "./session-manager.js";
@@ -38,8 +38,8 @@ import type { CliAgentRuntime } from "../executor.js";
 export interface CreateCliAgentRuntimeOptions {
   /** The project's `.fusion` dir (scratch root for hook scripts). */
   fusionDir: string;
-  /** The project's already-open core Database (reused, never re-opened). */
-  db: Database;
+  /** The project's already-open PostgreSQL data layer (reused, never re-opened). */
+  asyncLayer: AsyncDataLayer;
   /** Project this runtime drives (`cli_sessions.projectId`). */
   projectId: string;
   /**
@@ -82,7 +82,7 @@ export interface BootstrappedCliAgentRuntime {
    */
   isCliSessionWaitingOnInput: (taskId: string) => boolean;
   /** Tear down the PTY manager (scoped SIGKILL of this runtime's PTYs only). */
-  dispose: () => void;
+  dispose: () => Promise<void>;
 }
 
 /**
@@ -90,13 +90,15 @@ export interface BootstrappedCliAgentRuntime {
  * beyond the store's reads against the supplied Database; spawning a PTY or
  * running recovery is the caller's job (`resumeCoordinator.recoverOnStart()`).
  */
-export function createCliAgentRuntime(
+export async function createCliAgentRuntime(
   options: CreateCliAgentRuntimeOptions,
-): BootstrappedCliAgentRuntime {
-  const { fusionDir, db, projectId, hookEndpointUrl } = options;
+): Promise<BootstrappedCliAgentRuntime> {
+  const { asyncLayer, projectId, hookEndpointUrl } = options;
 
-  // 1. Store over the project's existing Database (thin query layer; no new conn).
-  const store = new CliSessionStore(fusionDir, db);
+  // FNXC:CliAgentPostgres 2026-07-14-12:00:
+  // Hydrate the project-scoped cache before state machines or recovery inspect
+  // it; mutations remain ordered through the shared PostgreSQL data layer.
+  const store = await CliSessionStore.create(asyncLayer, projectId);
 
   // 2. A per-runtime registry with every bundled adapter (not the process-wide
   //    singleton — avoids duplicate-registration across multi-project boots).
@@ -163,8 +165,9 @@ export function createCliAgentRuntime(
         return false;
       }
     },
-    dispose: () => {
+    dispose: async () => {
       manager.dispose();
+      await store.flush();
     },
   };
 }