Slices 2-4: Work becomes executable

Domain primitives: versioned WorkDefinition/DesignPacket with risk, questions,
and approval gates; lifecycle transition table with invalidation rules;
Resolver (Run/Attempt/outcomes/CodingKitV0); provider-neutral HarnessRuntime
with normalized events and a deterministic FakeHarnessLive that always reaches
a terminal classification and never claims implementation.

Convex durable model: workDefinitions, workQuestions, workApprovals,
designPackets, workSlices, workRuns, workAttempts, workAttemptEvents tables;
broadened works.status union; generalized workEvents with optional signalId,
referenceId, and payloadJson. Authenticated commands for definition request/
save/revise/approve, question answer/withdraw, design save/revise/approve, and
simulated execution start/cancel/retry with leased attempts, checkpointed
events, and expired-lease reconciliation.

Private work-planner FLUE agent with proposal-only tools (definition, design,
question). Convex validates and stores every proposal; FLUE never approves or
advances Work.

Expanded Work card with Outcome, Design, and Build sections wired to the new
mutations. Slice 1 conversation and provenance preserved.

packages/primitives/package.json

@@ -15,7 +15,12 @@
     "./project-workspace": "./src/project-workspace.ts",
     "./signal": "./src/signal.ts",
     "./smoke": "./src/smoke.ts",
-    "./work": "./src/work.ts"
+    "./work": "./src/work.ts",
+    "./work-definition": "./src/work-definition.ts",
+    "./work-design": "./src/work-design.ts",
+    "./work-lifecycle": "./src/work-lifecycle.ts",
+    "./resolver": "./src/resolver.ts",
+    "./harness-runtime": "./src/harness-runtime.ts"
   },
   "scripts": {
     "check-types": "tsc --noEmit",