Implement issue execution lock with deferred wake promotion

Add per-issue execution lock (executionRunId, executionAgentNameKey,
executionLockedAt) to prevent concurrent runs on the same issue.
Same-name wakes are coalesced into the active run; different-name
wakes are deferred and promoted when the lock holder finishes.

Includes checkout/release run ownership enforcement, agent run ID
propagation from JWT claims, wakeup deduplication across assignee
and mention wakes, and claimQueuedRun extraction for reuse. Adds
two DB migrations for checkoutRunId and execution lock columns.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/auth.ts

@@ -63,7 +63,7 @@ export function actorMiddleware(db: Db): RequestHandler {
         agentId: claims.sub,
         companyId: claims.company_id,
         keyId: undefined,
-        runId: runIdHeader || undefined,
+        runId: runIdHeader || claims.run_id || undefined,
       };
       next();
       return;