Board: connect exact local sessions, work, runs, and worktrees

[jeffhuber]

Part of #945 and roadmap #900.

Problem

Fixture-backed Board views cannot narrate real local session work until saved briefs, leases, work/run records, and maintained local execution paths are correlated through exact repository and worktree identity.

Scope

Connect the accepted Board observation contract to local Code Mower session, delivery, audit, controller, and builder evidence. Reuse #935's strictly read-only current brief/lease resolver and exact checkout boundary. Emit or derive only the minimum closed lifecycle facts needed by Board: opaque session/work/run correlation, repository/worktree binding, role/provider, safe stage/action/reason codes, event/observation times, bounded heartbeat evidence, and current PR/head association.

Do not scan by mtime, join by PID/provider/author alone, infer task identity from command arguments, renew/take over a lease, or require adopters to hand-author agent card JSON. Do not connect remote providers in this issue.

Dependencies

• Board: freeze the provider-neutral observation contract and truth fixtures #946 — observation contract and truth fixtures.
• Sessions: discover the current local brief and lease from a checkout #935 current local brief/lease discovery.
• Reuse existing maintained local runner and evidence paths; do not create a parallel execution path.

Acceptance criteria

• A maintained local execution can appear as assigned/dispatched/running/reported/completed before or after a PR without reading private prose.
• Session, work, run, repository, worktree, role/provider, PR, and head bindings are validated before correlation.
• Two sessions in separate worktrees remain distinct; a Board scoped to one checkout states that scope.
• A lease is displayed as coordination ownership and never by itself as liveness; expired lease does not prove process termination.
• Process-only observations remain work unlinked; several launcher processes do not inflate one run into several agents.
• Restart, missing brief, expired/malformed/replaced lease, absent producer, stale heartbeat, unlinked process, and no-session cases remain deterministic and read-only.
• Board observation performs no dispatch, retry, message, cancel, merge, or filesystem authority mutation.
• Public Board output remains free of local paths, session identifiers where not explicitly allowlisted, task prose, prompts, transcripts, raw output, source, and context.

Initial ownership

Provider-neutral session/events track, sequential after B0 and coordinated with #935. Planned builder: Code Mower Codex.

Code Mower delivery

Produce one independently reviewable PR for this issue. Record the named Code Mower builder, keep one writer on the branch, obtain an independent audit against the exact current head, resolve every P0/P1/P2 finding, and pass focused tests, relevant full tests, privacy checks, normal CI, and code-mower/gate. Upload only allowlisted metadata. No umbrella PR.