Migrate Confluence and Notion action resolution

[ndisidore]

This adds shared gatekeeper action helpers and migrates Confluence and Notion to implement applyActionsThrough. Both gatekeepers serialize resolution work, apply pending actions in order, stage vetoes, and report cascade invalidations to the overseer. InvalidationLog preserves invalidation attribution across retries and crashes. This PR is stacked on the contract-and-driver PR and contains no additional workshop kernel changes. Covered by the backend-utils, Confluence, and Notion suites, the full workspace tests, and the manual Workers AI smoke test.

[github-actions]

Preview: pr379-feat-action-a-c6f0fa71

https://pr379-feat-action-a-c6f0fa71-router.cloudflare-os-previews.workers.dev

Dashboard · deleted when this PR closes

[ask-bonk]

1. P1: Auto-approved actions can remain pending indefinitely. submitAction() eagerly starts syncActions(), which can observe "staged" and stop; promotion schedules no retry. See confluence-actions.ts:663 and notion-actions.ts:1131.

2. P1: Veto cascades delete staged actions before the overseer necessarily records them. The invalidation is then ignored, submission returns normally, and later approval marks the missing action approved without executing it. See confluence-actions.ts:630 and notion-actions.ts:1098.

3. P1: A crash after persisting "staged" but before promotion or rollback permanently blocks all subsequent actions at that record. See confluence-actions.ts:454 and notion-actions.ts:1045.

4. P2: InvalidationLog.prune() can remove attribution after an intervening request, so a later repeat of the original request no longer reports its invalidations, violating the RPC contract. See gatekeeper-action.ts:71.

github run