Add ops hq local worker for queued modeling intents

[roccho-dev]

Purpose

Add the ops-owned local worker that processes queued modeling intents after editor confirmation.

Scope

• Read queue JSONL rows validated by the ops queue validator.
• Process hq.modelCommitQueued.v1 into local shadow model operations.
• Process hq.agentTaskQueued.v1 into pending agent-task state.
• Write failed results for malformed or invalid rows.
• Prevent duplicate same-run idempotency processing.

Done

• modelCommit row -> processed receipt candidate and shadow state update.
• agentTask row -> pending receipt candidate and pending state update.
• invalid row -> failed receipt candidate.
• duplicate idempotency key -> not reprocessed.

Scope-achievement declaration

This issue is complete only when all of the following are true:

• Purpose lineage: directly owns queue-to-runtime processing and enables projection-to-ui without placing worker logic in edits or ui.
• Core/port/adapter: worker core is pure queue rows + prior state -> next state + receipt candidates; queue reader/state writer/receipt writer are ports; file IO is adapter.
• Pure/effect split: no file, clock, process, network, or UI side effect is inside worker core; all such effects live in adapters.
• False-positive exclusion: valid modelCommit and agentTask queue rows must process into expected state/receipt candidates.
• False-negative exclusion: invalid rows, duplicate idempotency keys, authority-confusing rows, and malformed JSONL must fail or become failed receipts as specified.
• Authority boundary: worker processing is local runtime evidence only; it does not write accepted ledger.
• Repo cleanliness: worker does not import editor UX, Vim, browser rendering, or UI preview code.

Non-goals

• Do not write accepted ledger.
• Do not produce UI HTML.
• Do not run a real agent.

Checks

• queue -> worker -> state fixture check.
• malformed row check.
• duplicate idempotency check.
• pure-core/unit tests and adapter tests are separate.
• Existing ops checks pass.

Depends on

• Add ops-owned hq queue schema and validator #40

Why this matters

This moves the actual queue runtime out of edits and into the correct operational layer.