Add shared external forge-effect reconciliation

[taras]

Story

As a workflow host implementor, I want one reconciliation contract for forge mutations, so Git push, pull-request creation, and issue creation do not invent separate replay policies or duplicate uncertain external effects.

Contract

An external effect derives stable identity from the WorkflowRun and expansion. It records filtered inputs, pre-state, observations, decision, and result locally, but does not claim a transaction across SQLite and the provider.

On first execution or resumption:

1. observe provider state using the stable identity and effect-specific natural keys;
2. adopt proven compatible completion;
3. perform proven absence;
4. reject conflict or permanent ambiguity; and
5. let explicit middleware retry or suspend temporary unavailability.

The forge provider is contextual and provider-neutral. GitHub is the first adapter, not a type in shared component contracts.

Acceptance

• Add a deterministic Git.Push workflow effect #370, Add a deterministic PullRequest workflow effect #295, and Add a deterministic provenance-linked Issue workflow effect #296 use the same reconciliation state machine.
• Replaying a recorded completion performs no provider mutation.
• Interruption after remote success but before local result publication adopts only provably compatible state.
• Conflicting external state is diagnosed rather than silently overwritten or duplicated.
• Inputs, pre-state, observations, decision, and filtered result are durable.
• Temporary unavailability is distinguishable from proven absence and permanent ambiguity.
• Credentials and raw provider payloads do not bypass the journal security boundary.
• Shared production code uses contextual forge APIs and contains no GitHub runtime coupling.

Dependencies

• Add contextual workflow runs with pinned commits #289 supplies run and expansion identity.
• Store WorkflowRuns and filtered journals in SQLite #291 supplies the filtered durable journal.
• Add workflow inspection, cancellation, suspension, and deletion #367 supplies suspension and lifecycle ownership.
• End goal: Document adversarial implementation workflow WIP #181.