Implement app state SSE endpoint

[enricopiovesan]

Summary

• Adds GET /v1/workspaces/{workspace_id}/apps/{app_id}/events as an app-scoped SSE endpoint.
• Records runtime execution events for state_changed, capability_invoked, capability_result, error, plus heartbeat behavior for empty streams.
• Supports Last-Event-ID replay for retained app events and EventSource-compatible headers.
• Updates Spec 033/OpenAPI and HTTP JSON smoke coverage.

Governing Spec

• 033-http-json-api
• 004-spec-alignment-gate

Project Item

• State subscription endpoint: SSE stream for app state events #526

Scope note

• This implements the app event stream contract and replayable runtime events for issue State subscription endpoint: SSE stream for app state events #526.
• Live command-driven fan-out is still owned by the command dispatch slice (Command dispatch endpoint: POST command to app state machine #527), because that endpoint is the write path that will produce future app state-machine transitions.

Validation

• cargo fmt --check
• bash scripts/ci/openapi_structural_validation.sh
• bash scripts/ci/downstream_http_json_smoke.sh
• cargo test -p traverse-cli

Closes #526