feat(lastcode): reconcile managed project actions

[lastobelus]

LastCode environments currently discover checked-in Actions but do not save them as runnable Project Actions after setup or managed checkout refreshes.

This adds an event-sourced reconciliation command and a guarded LastCode helper that:

• installs every non-setup Action from t3.json with deterministic IDs
• adopts exact legacy imports without breaking keybindings or local permissions
• tracks environment-local ownership and preserves locally diverged Actions
• defaults new Actions to untrusted and applies only explicit environment trust grants
• runs during setup, checkpoint-supervisor refreshes, and explicitly configured managed-checkout refreshes

t3.json currently declares Run Quick CI, so that is the CI Action installed from source; the issue’s older Run Full CI wording is superseded by the checked-in declaration. Existing unrelated or locally divergent Actions remain untouched.

Validation:

• 83 focused reconciliation, live/offline server, setup, trust, and refresh tests
• scoped server and scripts typechecks
• targeted lint and formatting
• Run Quick CI passed for 30139ecf6eec9fa6345f93966e5d940a86febc55 against 383e79487ee5eaab4442dc69a67d90818be61d14

Closes #108

Built with OpenAI Codex (GPT-5.6) in T3 Code.