Persist and gate pending agent actions

[yanpgwang]

Summary

• persist custom-tool and always-ask pending actions atomically with run completion
• gate ordinary queued runs until a matching durable resolution run closes
• validate correlation, action ownership, permission kind, duplicates, and restart/delete behavior
• keep sessions idle when ordinary work is admitted during an unresolved park
• document the explicit confirmation-execution and multi-action limitations

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• pending store tests repeated 30 times
• app custom-tool/gate tests repeated 10 times
• npm run typecheck
• npm run build
• git diff --check