fix(lastcode): make checkpoint failures self-reporting

[lastobelus]

The hourly checkpoint job can keep running while its latest durable record appears frozen: a retained recovery worktree blocks later attempts before they append history, and the old best-effort macOS notification has no acknowledgement, retry, or stable recovery thread. Nightly 1195 also exposed another deployed migration-number collision.

This adds a standalone supervisor with durable incident state, same-thread delivery and retry, deduplication, recovery closure, pinned bootstrap, environment scrubbing, and self-refresh. It also reserves upstream migration 43, shifts LastCode migrations forward, adds idempotent upgrade bridges for existing databases, and expands the checkpoint smoke gate to cover both bridge paths.

Validation:

• 49 focused tests across supervisor, service, checkpoint smoke, and affected migrations
• targeted lint with warnings denied
• scripts and server typechecks
• live launch-agent alert delivery and same-incident deduplication

Implemented with GPT-5.6 Codex in T3 Code.