fix: deduplicate CI watchers and remove task ID from watcher prompts

Prevent duplicate CI completion notifications in paired rooms by checking
for existing active watchers with the same channel+provider+metadata before
creating a new one. Remove Task ID from watcher prompt construction to
avoid router secret redaction (task- IDs contain sk- pattern), passing
EJCLAW_RUNTIME_TASK_ID via env var instead and making cancel_task
auto-resolve when task_id is omitted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

runners/agent-runner/test/watch-ci.test.ts

@@ -10,14 +10,13 @@ import {
 describe('watch-ci helpers', () => {
   it('builds a self-cancelling CI watch prompt', () => {
     const prompt = buildCiWatchPrompt({
-      taskId: 'task-123',
       target: 'PR #42 checks',
       checkInstructions:
         'Use gh pr checks 42 and summarize only terminal results.',
     });
 
     expect(prompt).toContain('PR #42 checks');
-    expect(prompt).toContain('task-123');
+    expect(prompt).not.toContain('Task ID:');
     expect(prompt).toContain('cancel_task');
     expect(prompt).toContain('send_message');
     expect(prompt).toContain('gh pr checks 42');