重构 worker 对话：复用 resume 机制，改专属 goroutine 运行

把「给运行中 Worker 发消息调方向」从自建的介入持久化协议，改为复用
已有的暂停/恢复 + transcript resume 能力，实现与主 Agent chat 一致。

- 拆 runWorkerStep：抽出 runIntent(执行+善后)，池子与消息路径共用一份
  善后逻辑；新增 runDetachedIntent，把意图 paused→running(不经 frontier)
  并在专属 goroutine 里直接跑，用户消息不受 3 槽池限制、随发随跑。
- 精简 sendWorkerMessage handler：校验 + emit 用户活动 + 专属运行；消息经
  ExecuteWithMessage 作为下一轮输入注入，request_id 仅做 transcript 去重。
- 删除介入 DB 协议与 15 处 activity 查询过滤(回退 exploration.go)、
  directedClaims 调度屏障、RecoverWorkerMessages 恢复、workerWake/waitWorker、
  AbortWorkIntervenedByUser。无 DB schema 改动。
- 前端：保留消息框，恢复「直接继续」(resume)按钮；发送改由 SSE 承载，
  去掉乐观插入。
- 取舍(低频可接受)：消息仅存内存，不做崩溃恢复；发消息时该任务可能瞬时
  超并发 1 个 worker。

净改动 9 文件 +583/-46(原 PR 15 文件 +1940/-72)。

server/worker_message_test.go

@@ -0,0 +1,54 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// After the worker-message rework, the human-message path no longer goes through
+// ControlWork with an "intervene" action — it runs the intent in a dedicated
+// goroutine (runDetachedIntent) and pauses, if needed, with the ordinary "pause"
+// action. Guard that ControlWork only knows pause|cancel so a reintroduced
+// "intervene" caller fails loudly instead of silently no-op'ing.
+func TestControlWorkRejectsRemovedInterveneAction(t *testing.T) {
+	e := NewEngine(nil)
+	err := e.ControlWork(context.Background(), 1, "intervene")
+	if err == nil || !containsUnsupported(err) {
+		t.Fatalf("intervene should be unsupported, got %v", err)
+	}
+}
+
+// A control request for an intent with no live work is a conflict, not a panic or
+// a silent success — the same guard the message handler relies on when a run has
+// already finished between the UI read and the request.
+func TestControlWorkConflictsWhenNoWorkRegistered(t *testing.T) {
+	e := NewEngine(nil)
+	err := e.ControlWork(context.Background(), 42, "pause")
+	if !errors.Is(err, errWorkControlConflict) {
+		t.Fatalf("pause with no work = %v, want errWorkControlConflict", err)
+	}
+}
+
+// validWorkerMessageRequestID gates the idempotency token; keep its charset stable
+// so a client-generated UUID is always accepted and injection-y ids are rejected.
+func TestValidWorkerMessageRequestID(t *testing.T) {
+	ok := []string{"worker-message-abc123", "a.b:c_d-1", "550e8400-e29b-41d4-a716-446655440000"}
+	for _, id := range ok {
+		if !validWorkerMessageRequestID(id) {
+			t.Errorf("id %q should be valid", id)
+		}
+	}
+	bad := []string{"", "has space", "emoji😀", "slash/here", string(make([]byte, 129))}
+	for _, id := range bad {
+		if validWorkerMessageRequestID(id) {
+			t.Errorf("id %q should be rejected", id)
+		}
+	}
+}
+
+func containsUnsupported(err error) bool {
+	return err != nil && !errors.Is(err, errWorkControlConflict) &&
+		strings.Contains(err.Error(), "unsupported work action")
+}