refactor(edge,router): claim router work durably before provider invocation

[ElbertePlinio]

Summary

Issue #37, CAND-4 (PR 4 in the master plan): operator-router's idempotency only became durable after provider work ran. Two concurrent requests for the same idempotency key could both find nothing completed, both invoke the OpenAI-compatible provider, and the losing response was simply discarded after the winner's debit landed — wasted provider spend with no compensating record.

This durably claims a router attempt before any provider invocation, so at most one caller ever owns "go call the provider" for a given (user_id, idempotency_key) at a time.

What changed

• New migration supabase/migrations/20260722000000_router_attempt_claim.sql: router_attempts table + router_attempt_claim / router_attempt_complete / router_attempt_fail RPCs (service_role only). A claim that's neither completed nor explicitly failed is recoverable once its lease elapses. Additive only — doesn't touch credit_ledger or debit_credits.
• packages/edge-shared/src/index.ts: claimRouteAttempt, completeRouteAttempt, failRouteAttempt, findDebitedRouteResult own the RPC/route-metadata encode-decode boundary. createOperatorRouterHandler now claims → invokes provider → completes → debits, releasing the claim immediately on a definitive provider failure and skipping straight to a debit retry (no re-invocation) when a claim is found already completed. Legacy credit_ledger rows written before this migration remain authoritative for old completed routes, independent of whether a router_attempts row exists.
• supabase/functions/operator-router/index.ts: wires the service-role client straight through; drops the adapter-owned findCompletedRoute query and debit callback.
• Fast unit tests (packages/edge-shared/test/edge-shared.test.ts): FakeRouterServiceSupabase reimplements the claim/complete/fail/debit RPC contract, covering the full choreography, live claims (409 attempt_in_progress), lease recovery, and debit-retry-without-re-invoking-the-provider.
• pgTAP (supabase/tests/database/router_attempt_claim.test.sql): claim/in_progress/completed outcomes, idempotent completion replay, failure recovery, lease-based recovery, per-user isolation, privilege grants, input validation.
• Local-Postgres contract lane (packages/edge-shared/test/router-attempt.contract.test.ts, following test(billing): checkout lifecycle contract tests against local Postgres #47/refactor(sync): durable settings-sync LWW (#37 CAND-3) #50's convention): proves the durable functions against real Postgres, including two genuinely concurrent claims for the same key resolving to exactly one claim, and a full createOperatorRouterHandler run proving the provider is invoked and the ledger is debited exactly once across two concurrent same-key requests. Wired into bun run test:supabase.
• Bumps @pickforge/* 0.11.0 → 0.12.0 and re-pins every Deno function's npm: import (existing publish-then-pin convention).

Validation

• bun run typecheck ✅
• bun run test — 366/366 ✅
• bun run build ✅
• supabase db reset — all migrations apply cleanly ✅
• bun run test:supabase against real local Postgres:
  • pgTAP — 178 tests (including the new router_attempt_claim lane) ✅
  • welcome-credits-concurrency.ts ✅
  • CAND-1 checkout-lifecycle.contract.test.ts — 20/20 (still green) ✅
  • CAND-3 sync LWW contract lane — 8/8 (still green) ✅
  • new router attempt contract lane — 8/8 ✅
• supabase db advisors --local --type security --fail-on warn — clean ✅
• deno check against the real npm registry isn't possible pre-publish (same documented gap as refactor(edge,billing): move fence/register/expire RPCs next to the deep lifecycle #48: published @pickforge/* is still behind main). Confirmed the pre-existing gap is unchanged — this diff's remaining deno check errors are a strict subset of main's — and validated the adapter's typing directly against local src via tsc instead.

Closes the "Router work is durably claimed before provider invocation" checklist item in #37.