fix(supervisor): complete proposal tool registry

[Qiyuanqiii]

Summary

• make every advertised Supervisor proposal tool valid across definition lookup, payload normalization, Gateway validation, domain validation, application allowlists, and production executor wiring
• add forward-only schema v109 so durable Supervisor calls accept child_task_propose, sandbox_docker_run_propose, and one_shot_command_propose while preserving existing rows and triggers
• connect the one-shot command proposal to its existing human review/execution chain
• fix ListOnceCommandProposals deadlocking on SQLite's single connection by closing the ID cursor before loading full records
• add registry parity and real Supervisor-to-ledger regression coverage

Root cause

Supervisor tools were registered in several independent allowlists. PRs #67, #62, and #78 added child-task, Docker, and one-shot proposal pieces without keeping every layer synchronized. Child and Docker calls were visible to the model but could not be persisted; one-shot calls were not reachable at all. Its operator list path also performed a nested query while holding SQLite's only connection.

Safety

• the migration is additive and preserves all existing call rows
• one-shot remains proposal-only; it does not execute until the existing human review and permission gates approve it
• command payloads remain redacted from the generic tool transcript

Verification

• go mod verify
• go test -count=1 ./...
• go vet ./...
• registry/README migration parity checks
• real Supervisor → one-shot proposal persistence → model result round trip