Gameplay: stage generic four-worker authority and settlement

[ael-dev3]

Summary

This is a draft, additive gameplay slice for the generic four-worker authority system. It is intentionally stacked on PR #82 and does not merge, seed, activate, backfill, deploy, or mutate production.

Dependency and exact refs

• Base PR: Fix: harden renderer recovery invariants and input handling #82
• Base branch: fix/realm-renderer-recovery-followup
• Base commit at implementation time: dc9ac4066cb4427dce733713e01789532fb661e3
• Head branch: agent/generic-castle-workers-v1
• Head commit: dbddbd6

Review this PR after the base PR. It preserves the base schema prefix and appends only the generic worker suffix.

What this PR adds

• Schema refs 47–52, appended after realm_water_revision_v1:
  • public staged realm_worker_system_v1 readiness singleton;
  • public-safe castle_worker_v1 roster;
  • private worker_assignment_v1 authority;
  • public worker_node_occupation_v1 generic node lease;
  • private worker_command_idempotency_v1 command receipts;
  • public-safe scheduled worker_assignment_schedule_v_1.
• Exactly four stable workers per castle with deterministic IDs:
  genesis-001-castle-<castleId>-worker-01 through -04.
• Any idle worker can gather Gold, Food, Wood, or Stone, including multiple workers on the same resource at different nodes.
• Dispatch, single recall, recall-all, exact server-time settlement, automatic availability, roster/resource procedures, scheduler transitions, admin status, and dry-run roster planning.
• Reused current site catalogs, route authority, rates, 60-second quantum, and 30-day cap.
• Existing expedition/occupation/schedule wires remain additive-compatible.

Public/private boundary

Public tables expose shared presentation only: castle/worker identity, lifecycle phase, route timing, resource kind, site, node lease, and scheduled transition metadata. They contain no FID, cargo, private accrual, balance, request key, or authentication data. Assignment, idempotency, settlement, and private resource state stay private.

State and settlement

Worker phases are idle -> traveling_out -> gathering -> returning -> idle. A generic node lease is deleted when return begins, so another worker may take it. Caller-bound reads calculate exact server-time availability without writing. Scheduled expiry and explicit dispatch/recall commands materialize complete quanta; there is no per-minute write loop and no generic collect command.

Legacy cutover and activation

The generic system remains staged in this PR. No production seed, activation, backfill, migration, or deploy operation is included. The active gate requires the readiness singleton, an exact four-worker roster and digest for every founded castle, and zero legacy expedition, occupation, and schedule rows before activation. Protocol remains 3 until a later client-capability release opts into the generic worker methods.

Migration proof

The v12 fixture asserts the exact v11 prefix followed by refs 47–52 and populates one row in every new table. The read-only verifier checks prefix preservation, append-only ordering, populated fixture coverage, and public/private privacy boundaries.

Validation

• SpacetimeDB module build
• Generated binding verification against SpacetimeDB CLI 2.6.1
• Backend TypeScript check
• Migration fixture TypeScript check
• 202 backend pure tests
• 1,756 root Vitest tests
• Additive migration proof and git diff --check

Residual risks / follow-up

This PR deliberately leaves production activation, roster seeding/backfill, client capability negotiation, aggregate optimization, and full live-loop integration for follow-up PRs. The current staged gate fails closed until an explicit admin-reviewed activation path is added.