feat: Add the internal thread-control foundation and Project discovery #959

Parent

#958

What to build

Deliver the first usable internal thread-control slice. A running Mcode agent can search registered Projects, receive exact workspaceId values, list opaque worktree identities, and use a shared ThreadControlService that enforces server-derived internal authority. Add the contracts, durable lineage and provenance foundation, migrations, and focused boundary tests required by later mutations.

Acceptance criteria

• An internal provider-session tool can search Project names and repository identities, including a bounded recent list for an empty query.
• Ambiguous Project matches remain separate and every authorized result includes workspaceId.
• Worktree discovery returns opaque identifiers and never exposes raw filesystem paths.
• The source thread cannot target itself.
• The shared contracts, migrations, and service boundary preserve existing threads and legacy messages.
• ADR 0021 authority and lifecycle rules are enforced by focused tests.

Canonical contract

Implement the shared schemas, exported limits, authority types, lineage and provenance persistence, ThreadControlService boundary, workspace_search, and worktree_list from the Agent Thread Control Contract. The contract is introduced by PR #967.

Blocked by

None. Can start immediately.