perf: reduce db egress for task context

[FrkAk]

Summary

Task Reference: [MYMR-228]

Cuts how much data we read from Postgres on the hottest read paths. Before this PR most reads fetched full rows even when the caller used a handful of columns — the task context endpoint fetched the full task three times per request.

Task context endpoint (GET /api/task/[id]/context)

• The agent/planning/working bundles each fetched the full task and walked the dependency graph independently: 3 full-task reads + 2 traversals per request. They now share one task read and one traversal inside a single RLS transaction; the markdown assembly is split into pure functions fed from that shared data.
• Conditional requests (HEAD / If-None-Match → 304) now read only the task's projectId instead of the full row.

MCP context tools (mymir_context)

• Each depth now selects only the task columns its output renders — e.g. working skips implementation_plan and execution_record; no depth reads history or category. Omitted columns come back as typed NULLs, so the row shape and all downstream code are unchanged.

Access checks

• The task access gate returned the full task row just to authorize; it now returns the 6 columns callers actually use. The project access row drops history/createdAt.

Workspace page loads

• The home-grid/sidebar project list drops history/categories/createdAt.
• Sidebar projects, user teams, and the project access row are memoized per request (React.cache), so the layout and page share one read instead of repeating it.
• Project overview caps task descriptions in SQL at the length the formatter truncates to anyway.

Task detail UX (the one visible change)

• Selecting a task renders the header instantly from the already-loaded graph data, with skeletons for the body until the full task arrives. Mutation surfaces that would see placeholder empties (assignee picker, files) stay disabled during that window so they cannot write empty data back.

Hardening from review

• A pre-resolved access row is verified against the projectId it is used for; a mismatch throws.
• The NULL-cast fragment that reaches sql.raw only accepts the literals "text" | "jsonb".
• An invariant test pins that the bundle's single agent-depth fetch covers every column the planning/working assemblers read.
• eslint . was permanently red because it scanned the nested git worktrees under .claude/worktrees/, re-flagging documented RLS-exempt files at paths the exemption globs don't match. Worktrees are now excluded, so the RLS lint gate fails loudly again on real violations.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)

Full suite: 620 tests pass.

Notes for reviewer

• Byte-identity is proven, not claimed. The golden snapshot tests for all five context depths and the API bundle were run against main's pre-refactor implementation with this branch's snapshots — they pass on both sides. The overview description cap is asserted equal to compress() over the full string, including astral characters.
• Query-count tests (spies on the task fetch and the traversal) pin the "one read, one traversal" property of the bundle endpoint, and that the 304 path never touches the full task.
• Apart from the detail-panel skeleton, no behavior change is intended anywhere.