feat(run): bounded per-worker escalation in ak run (ADR-0019)

[robertelee78]

Summary

The #76 closure punch list requires ordered, bounded cross-host escalation in the canonical ak run path — tested with an OpenCode-qualified route — and explicitly says keeping escalation only in deprecated ak dual does not satisfy the issue. This lands it, with the migration decision recorded as ADR-0019.

Design (ADR-0019) — bounded per-worker ladder attempts, opt-in via --escalate:

• The resolved route's escalate array travels with each worker at materializeRunPlan; self-equal rungs are dropped (legacy L4 rule) and unroutable rungs fail materialization exactly like an unroutable primary route.
• A cleanly-failed worker (failed/timed_out) advances one rung per attempt in ladder order, bounded by the ladder's length; --timeout applies per attempt.
• Never advanced: blocked/cancelled (dependency state, not a worker failure), permission_required (a consent boundary — escalating around it would violate the supervised-host contract the opencode abort implements), orphaned (uncertain state → double-run risk).
• The final result carries attempts[] (host/model/status/category/duration/reason) only when more than one attempt ran — a single attempt is indistinguishable from escalation off, and a fabricated trail would be a lie. Final host/model = the rung that executed (observed truth); attempts is schema-validated like every other result field; success-after-escalation unblocks dependents; a rung with no adapter records cli_unavailable and continues.
• ak dual keeps its legacy whole-pipeline semantics untouched until GA blocker: remove all deprecated commands, compatibility code, and legacy documentation #83 removes the wrapper; the deliberate semantic difference is named in UPGRADING.md.

Verification

• 13 new tests: engine ordering/bound/exclusions/trail/schema-validation (incl. an OpenCode-qualified route through injected adapters), plan materialization + unroutable-rung rejection, CLI flag flow, --dry-run ladder display.
• pnpm run check exit 0 (1080 kit + cjs), pnpm run test:surface exit 0 (25).
• Live OpenCode-qualified proof (sandboxed repo, real claude + opencode CLIs, implementation:opencode with a bogus provider/model):

  coder: opencode:failed(worker_error) -> claude:succeeded(success)
  

  The opencode attempt fails with the serve's 400, advances to the claude rung, which succeeds and writes the mutation (hello.mjs, typed). Dependents unblocked; permission/consent surfaces untouched.

Refs #76 (punch-list item 1), #83 (the wrapper removal that consumes this migration).