fix: wire audit loop into worker completion path (pushback delivery, escalate, packet preamble)

Audit-loop wiring, worker completion path only: after the final
write-back (and only when the final is completed/failed, not quota,
not cancelled, not goal-converted, and the task carries audit_loop),
collect this attempt's deterministic gate results (execution,
goal_verify only when host reported goal_met, capability /
required_tools / gateway as passed-or-inapplicable markers, since a
pre-dispatch gate rejection early-returns before any runner round
and requeueing it would deterministically re-fail the same gate)
and call audit_loop_evaluate. Pushback stores the packet JSON in
tasks.audit_loop_packet and CAS-requeues the task; the next claim
prepends the packet preamble to prompt (and goal) with a data-only
separator, DB prompt untouched. Pass clears the packet. Escalate
sets failed (VALID_STATUSES has no needs_review, never invented)
with an escalation error and clears the packet; subjective
needs_review leaves the outcome untouched and only audits.
New tasks.audit_loop / audit_loop_packet columns follow the
attempts DDL pattern in worker ensure, server migrate, PG schema,
PG backfill, migrations backfill, and POST /tasks accepts
audit_loop (True/1 only, coordinator tasks rejected like v9).
Coordinator parent tasks return via _run_coordinator before the
attempt loop and coordinator children never inherit audit_loop,
so coordinator wiring is left as legacy, unchanged.

cloud/db.py

@@ -906,6 +906,8 @@ POSTGRES_SCHEMA = (
     "agent_instructions TEXT, "
     "agent_tools TEXT, "
     "agent_tool_approvals TEXT, "
+    "audit_loop INTEGER, "
+    "audit_loop_packet TEXT, "
     "UNIQUE(project_id, idempotency_key))",
     "CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status)",
     # 附件包与任务附件：与 server._ensure_uploads_tables 同款，
@@ -1155,7 +1157,10 @@ def init_postgres_schema(conn):
                          ("agent_version", "TEXT"),
                          ("agent_instructions", "TEXT"),
                          ("agent_tools", "TEXT"),
-                         ("agent_tool_approvals", "TEXT")):
+                         ("agent_tool_approvals", "TEXT"),
+                         # 审计循环接线：开关与上一轮推回包。
+                         ("audit_loop", "INTEGER"),
+                         ("audit_loop_packet", "TEXT")):
         if _name not in tcols:
             conn.execute(
                 "ALTER TABLE tasks ADD COLUMN %s %s" % (_name, _type))