Platform hardening for recoverable agent workflows

[akgohain]

Summary

Establishes the shared technical substrate for a recoverable, resource-bounded, agent-mediated segmentation workflow.

• Adds stable API error envelopes and frontend recovery handling.
• Adds bounded volume metadata/region access and safer Neuroglancer serving.
• Persists workflow operations with idempotency, cancellation, retry, and evidence correlation.
• Enforces typed, approval-gated agent action definitions.
• Adds bounded file browsing, a deterministic synthetic project, and browser smoke coverage.

Scope boundary

Worker completion/cancellation reconciliation, OME-Zarr materialization, chunk-aligned proofreading overlays, and remaining server-owned execution work are intentionally follow-on layers in the planned stack.

Verification

The branch scope records successful backend and frontend suites, a deterministic Chromium smoke, and a production frontend build. CI should validate the current tip before review.