#7143 fix(execution): make function runs rollout-safe

Summary

• execute trusted Function tools directly in the workflow owner while retaining the compatibility adapter for rolling deployments
• reconnect E2B and Daytona by stable process identity and make ambiguous launches non-retryable
• make manual execution observers detachable with Redis push replay, refresh-safe active block state, and no polling fallback
• extend the existing unit and provider conformance coverage for execution, reconnect, cancellation, and refresh behavior

Runtime behavior

• no long Sim-to-Sim Function HTTP request for new executors
• browser SSE is an observer and page refresh rehydrates active pulses and terminal events
• external sandbox commands are launched once, then observed or reconnected by exact provider identity
• Trigger.dev executions use the same direct Function path inside their existing task owner
• the legacy Function route remains temporarily so old-blue tasks can call new-green during this rollout

Testing

• bun run type-check (26/26)
• bun run check:audits (33/33)
• targeted rollout and provider suites (319 passed)
• real Redis and isolated-vm lifecycle validation, including observer refresh and cancellation
• live E2B execution validation
• live Daytona parity: 7 passed, 0 failed, 3 optional fixture skips
• live Daytona execution validation
• Sim app suite: 34,705 passed; 16 loopback tests rerun outside the restricted sandbox and passed

The standalone ad hoc rollout harness used for live validation is intentionally not included in this PR.