fix: salvage EJClaw runtime hardening

- add dist freshness guard to deploy flow
- preserve message source provenance for IPC injection
- harden Codex usage fallback and workspace package manager detection
- document owner branch return protocol

src/db/migrations/index.ts

@@ -12,6 +12,7 @@ import { PAIRED_WORKSPACE_PROJECT_SCHEMA_CLEANUP_MIGRATION } from './009_paired-
 import { PAIRED_TURN_PROVENANCE_UPGRADE_MIGRATION } from './010_paired-turn-provenance-upgrade.js';
 import { OWNER_FAILURE_COUNT_MIGRATION } from './011_owner-failure-count.js';
 import { PAIRED_VERDICT_AND_STEP_TELEMETRY_MIGRATION } from './012_paired-verdict-and-step-telemetry.js';
+import { MESSAGE_SOURCE_KIND_MIGRATION } from './013_message-source-kind.js';
 import type {
   SchemaMigrationArgs,
   SchemaMigrationDefinition,
@@ -32,6 +33,7 @@ const ORDERED_SCHEMA_MIGRATIONS: readonly SchemaMigrationDefinition[] = [
   PAIRED_TURN_PROVENANCE_UPGRADE_MIGRATION,
   OWNER_FAILURE_COUNT_MIGRATION,
   PAIRED_VERDICT_AND_STEP_TELEMETRY_MIGRATION,
+  MESSAGE_SOURCE_KIND_MIGRATION,
 ];
 
 function ensureSchemaMigrationsTable(database: Database): void {