fix(runtime): record company_id on FUSE workspace and CLI agent state

[wg2038]

Problem & Real-World Impact

Cumora enforces per-tenant multi-tenant isolation where per-agent data (agent_workspace, agent_climate, agent_tasks, agent_log) must be scoped to company_id (as added in schema migrations 583-636, 718, 835, 1885 and documented in skills.ts:250-252 and cli.ts:55-58).

However, several write paths omitted company_id when persisting records:

1. server/src/agents/runtime/fs-endpoints.ts (PUT /runtime/fs/write):
   When agents write files to /workspace via the FUSE virtual filesystem driver in their pod, c.companyId was available in the JWT claims but omitted from the INSERT INTO agent_workspace statement, leaving company_id as NULL.

   • Devtools Workspace Explorer Broken: GET /devtools/agent-workspace/tree and /file (router.ts:5357, 5377) query WHERE agent_id = $1 AND company_id = $2. Because company_id was NULL, files written by agents via FUSE were completely invisible in the UI (returning [] or 404).
   • Data Retention / Orphan Leak (GDPR Risk): DELETE /api/companies/:id (router.ts:1827) cleans up soft-scoped tables using DELETE FROM ${table} WHERE company_id = $1. Because company_id was NULL, files created via FUSE were never deleted upon workspace deletion, permanently leaving orphaned agent workspace data in Postgres after the owner and participants were removed.
   • Agent Rename Cascade Failure: During agent rename (cascadeAgentIdChange), agent_workspace is updated with WHERE company_id = $3 (migrate.ts:1885). NULL company_id rows failed to match, severing file ownership upon rename.

2. server/src/agents/cli.ts & climate.ts:

   • tasks add: retrieved companyId = await agentCompany(me) on line 4448 and emitted it in telemetry, but omitted company_id in INSERT INTO agent_tasks.
   • climate note & bumpClimate: omitted company_id in INSERT INTO agent_climate, causing records to default to 'personal' and bypass workspace deletion.
   • memory note & log note: omitted company_id in INSERT INTO agent_log.

---

Solution

1. FUSE File Writes:
   • Include company_id: c.companyId in INSERT INTO agent_workspace in server/src/agents/runtime/fs-endpoints.ts.
   • Update company_id = COALESCE(EXCLUDED.company_id, agent_workspace.company_id) on conflict.
2. CLI Tasks, Climate & Log:
   • Populate company_id in agent_tasks, agent_climate, and agent_log.
   • Query participant's company_id in bumpClimate in server/src/agents/climate.ts.
3. Workspace Deletion Defense-in-Depth:
   • In DELETE /api/companies/:id (server/src/api/router.ts), explicitly purge any per-agent rows for the company's agentIds across ['agent_workspace', 'agent_memory', 'agent_log', 'agent_tasks', 'agent_climate'] to guarantee zero orphaned data even for pre-existing or legacy rows.

---

Verification

• FUSE Runtime Writes:
  • Verified with dedicated repro test that company_id previously stored null, now stores the authenticated companyId.
  • Added assertion in server/src/__integration__/runtime-server.test.ts to assert agent_workspace.company_id matches the agent's tenant (34/34 pass).
• Workspace Deletion Cascade:
  • Extended server/src/__integration__/workspace-management.test.ts to seed agent_workspace, agent_tasks, agent_climate, and agent_log, delete the workspace, and assert all rows are completely purged from Postgres (12/12 pass).
• Full Test Suites & Guards:
  • npm test: 1127 passed, 4 skipped, 0 failed.
  • npm run test:integration: 297 passed, 5 skipped, 0 failed.
  • npm run lint: 485 files checked, 0 errors.
  • npm run typecheck & npm run server:typecheck: 0 errors.
  • npm run guard:big-brain, guard:llm-tracked, guard:engine-registry: all passed.