fix: deduplicate CI watchers and remove task ID from watcher prompts

Prevent duplicate CI completion notifications in paired rooms by checking
for existing active watchers with the same channel+provider+metadata before
creating a new one. Remove Task ID from watcher prompt construction to
avoid router secret redaction (task- IDs contain sk- pattern), passing
EJCLAW_RUNTIME_TASK_ID via env var instead and making cancel_task
auto-resolve when task_id is omitted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/ipc.ts

@@ -11,7 +11,13 @@ import {
 } from './config.js';
 import { readJsonFile } from './utils.js';
 import { AvailableGroup } from './agent-runner.js';
-import { createTask, deleteTask, getTaskById, updateTask } from './db.js';
+import {
+  createTask,
+  deleteTask,
+  findDuplicateCiWatcher,
+  getTaskById,
+  updateTask,
+} from './db.js';
 import { isValidGroupFolder } from './group-folder.js';
 import { logger } from './logger.js';
 import {
@@ -394,6 +400,28 @@ export async function processTaskIpc(
           nextRun = date.toISOString();
         }
 
+        // Deduplicate CI watchers: if another agent already watches the same
+        // channel + provider + run, skip creation to avoid duplicate notifications.
+        if (data.ci_provider && data.ci_metadata) {
+          const existing = findDuplicateCiWatcher(
+            resolvedTargetJid,
+            data.ci_provider,
+            data.ci_metadata as string,
+          );
+          if (existing) {
+            logger.info(
+              {
+                existingTaskId: existing.id,
+                existingAgentType: existing.agent_type,
+                ciProvider: data.ci_provider,
+                sourceGroup,
+              },
+              'Duplicate CI watcher skipped — another agent already watches this run',
+            );
+            break;
+          }
+        }
+
         const taskId =
           data.taskId ||
           `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;