fix: deduplicate CI watchers and remove task ID from watcher prompts

Prevent duplicate CI completion notifications in paired rooms by checking
for existing active watchers with the same channel+provider+metadata before
creating a new one. Remove Task ID from watcher prompt construction to
avoid router secret redaction (task- IDs contain sk- pattern), passing
EJCLAW_RUNTIME_TASK_ID via env var instead and making cancel_task
auto-resolve when task_id is omitted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/db.ts

@@ -936,6 +936,25 @@ export function getTaskById(id: string): ScheduledTask | undefined {
     | undefined;
 }
 
+/**
+ * Find an existing active/paused CI watcher for the same channel + provider + metadata.
+ * Used to prevent duplicate watchers when both agents register for the same CI run.
+ */
+export function findDuplicateCiWatcher(
+  chatJid: string,
+  ciProvider: string,
+  ciMetadata: string,
+): ScheduledTask | undefined {
+  return db
+    .prepare(
+      `SELECT * FROM scheduled_tasks
+       WHERE chat_jid = ? AND ci_provider = ? AND ci_metadata = ?
+         AND status IN ('active', 'paused')
+       LIMIT 1`,
+    )
+    .get(chatJid, ciProvider, ciMetadata) as ScheduledTask | undefined;
+}
+
 export function getTasksForGroup(
   groupFolder: string,
   agentType?: AgentType,