Finish CloudJob to TaskRun migration

[mrubens]

Summary

• replace CloudJob/CloudTask compatibility types and IDs with TaskRun/run vocabulary
• move REST, SDK, tRPC, web, queue, controller, worker, and integration surfaces to task-run naming
• rename runtime metrics, logs, auth tokens, events, and files without public compatibility aliases
• merge the latest origin/develop schema and web updates
• relax one Slack routing test timeout that repeatedly exceeded 5 seconds only under full-suite load

Validation

• pnpm lint
• pnpm check-types
• pnpm test (24/24 packages)
• pnpm knip
• legacy vocabulary scan
• git diff --check

[roomote-roomote]

Re-reviewed the latest update: the [Chore] Remove agent identity model (#110) change plus a follow-up develop-alignment commit and a merge of origin/develop. The net-new work in this PR's own diff finishes retiring the CloudAgentType identity model in favor of workflow discriminators — source-control automation gates now take workflow: 'pr_review' | 'pr_conflict_resolve' (SourceControlAutomationWorkflow) instead of a CloudAgentType, PrReviewerSettings/DEFAULT_PR_REVIEWER_SETTINGS were renamed to PrReviewSettings/DEFAULT_PR_REVIEW_SETTINGS, and the router dropped availableAgents/agentType/selectedAgent (and RoutableAgent, GITHUB_ONLY_AGENT_TYPES, NON_ROUTABLE_AGENT_TYPES) from its context, results, and Slack/Linear debug output. CloudAgentType now has zero references anywhere in the codebase, every consumption site (webhook handlers, routeGitHubTask followUpMode, prompt builders) was updated consistently, and no dangling references remain. The much larger file set in the raw since-last-review delta comes from the two merge commits pulling in origin/develop; that base-branch code is out of scope for this PR. No new code issues found. Both earlier deploy-time compatibility notes remain resolved in this range: task-run-queue.ts only had comment edits (the legacy queue:cloud-jobs drain path is intact) and run-token.ts was untouched. See task

Deploy-time compatibility notes (resolved)

• 🟡 Redis queue key renamed with no drain path — packages/cloud-agents/src/server/task-run-queue.ts still drains the legacy queue:cloud-jobs key on top of develop's new atomic queue:cloud-jobs:v2 queue: dequeue() lpops the legacy key and claims its scope lock before the v2 ATOMIC_DEQUEUE_SCRIPT, and enqueue() removes/evicts same-scope legacy entries before the atomic v2 enqueue. New work is still written only to the v2 keys, so pre-migration entries drain naturally instead of being orphaned. This latest update only edited comments in this file, so the note remains resolved.
• 🟢 Run-token type discriminator switched to a hard match — packages/auth/src/run-token.ts validates with a private compatibleRunTokenPayloadSchema that accepts t: 'run' | 'cj' and normalizes the result to tokenType: 'run'. Minting and the exported payload contract stay strictly t: 'run', so in-flight pre-deploy tokens keep authenticating until they age out. This file was not touched by the latest update, so the note remains resolved.

_{No approval performed. No unresolved review findings remain.}

[mrubens]

Addressed both deploy-time compatibility notes in 6a2a3c3:

• The task-run queue now drains queue:cloud-jobs before the current queue and deduplicates scopes across both keys. New work is still written only to queue:task-runs, so the old list drains naturally without preserving a public alias.
• Run-token validation privately accepts signed pre-deploy t: cj tokens and immediately normalizes them to tokenType: run. The exported payload schema and token minting remain strictly t: run, so this only covers in-flight tokens until their existing TTL expires.

Added focused queue and token rollover tests. Full pnpm check passes.