feat(team): leader-only warmup with lazy teammate wakeup and per-member attach

[piorpua]

Summary

Lazify team warmup. Previously, entering a team session warmed up every member via a batch rebuild_agent_processes (bounded concurrency + staggered start), showing a full-screen "waking up team" overlay. This was slow, race-prone, and all-or-nothing: a single member's attach failure failed the whole first start and kill_and_wait-ed the members that had already started.

This PR adopts spec approach A — reuse the existing single-member attach primitive and collapse the team runtime onto one attach path, with teammates started lazily.

Paired with the AionUi frontend PR on the same branch, which consumes the new dormant runtime status, the POST /api/teams/{id}/agents/{slot_id}/attach route, and the team.slotWorkChanged event.

Key changes

• Leader-only first start: cold start attaches only the lead slot via reserve_attach + attach_member_runtime. On leader success it broadcasts leader Ready; other teammates broadcast the new Dormant status and stay Absent with no event loop; then session Ready(server_count = total member count) is broadcast.
• Remove the batch machine: delete rebuild_agent_processes, spawn_rebuild_agent_process, cleanup_bootstrap_runtime_tasks and the concurrency/stagger logic. seed_ready is kept but gated #[cfg(test)]. The whole codebase now has a single attach orchestration path shared by leader cold-start, reconciliation, add_agent, spawn_agent, lazy wakeup, and directed retry.
• Lazy wakeup (ensure_member_runtime_lazy): hooked into both delivery entry points (human→teammate enqueue_user_message, agent→teammate send_agent_message_from_agent) before publish_runtime_constraint. If the event loop is running it returns; otherwise it resolves service/published-session first (to avoid a dangling Attaching lease), does a synchronous reserve_attach (flips the snapshot to Attaching to close the race window), broadcasts Pending, and spawns the attach in the background. The lease deduplicates concurrent deliveries into a single attach.
• Preserved-unread failure + source-gated leader notify: attach_member_runtime / spawn_attach_agent_process_bg take a notify_leader_on_failure: bool. A failed attach converges runtime state to Failed but no longer calls mark_read_batch on terminal_message_ids, so the triggering message stays read=0 and a retry re-drains it via reconcile_mailbox. The leader is notified only when notify_leader_on_failure = true (agent-triggered delivery and leader-initiated spawn_agent), not for human-direct deliveries, add_agent, reconciliation, leader cold-start, or the directed retry route.
• Reconciliation skips dormant: reserve_member_runtime_reconciliation skips non-lead Absent members so a second ensure_session (re-warmup / model switch / retry) does not wake all dormant teammates; leader, Ready-repair, Failed-retry, and in-flight Attaching/Removing still reconcile.
• refresh_member_runtime_status is leader-scoped: it reads only the leader snapshot (leader Ready ⇒ team Ready(server_count = total)); teammate dormant/pending/ready/failed is expressed per-member via agentRuntimeStatusChanged and no longer flips session status. This keeps the overlay from being raised by teammate state and a single teammate failure from raising the full-screen failure card.
• Session-level Starting overlay is strictly leader-scoped; teammate reconciliation failures stay inline instead of failing the whole team; first-start recovery drain scans only the leader (teammate unread is deferred to lazy start + reconcile_mailbox).
• New directed retry route POST /api/teams/{id}/agents/{slot_id}/attach: attach_agent handler in routes.rs, attach_agent_runtime in service.rs (load_owned_team → idempotent ensure_session_inner → reserve_attach(slot, true) → background spawn_attach_agent_process_bg(..., false)). State-changing; auth + CSRF via the same team router middleware as add/remove/send.
• New team.slotWorkChanged event + TeamSlotWorkChangedPayload: broadcasts per-slot work changes for run-less slots (e.g. the leader self-waking to drain its mailbox), which the run-scoped team.run* events do not cover. Naming follows domain.camelCaseAction.
• Observability: per-member agentRuntimeStatusChanged and session-status broadcasts raised to info; lazy-wakeup boundary logs at info (team_id/slot_id/trigger=human|agent, no sensitive payloads).

Semantic drift called out for reviewers (spec-approved, not a bug)

The full-screen warmup overlay and the multi-member failure card now reflect the leader only. server_count still equals total member count but no longer implies all members are ready.

Database / migrations

None. requires_database_schema_change = false; no migration files added. Mailbox delivery semantics are unchanged (writes read=0, messages are never lost).

Testing

• cargo fmt --all -- --check — clean
• cargo clippy --workspace -- -D warnings — clean (push gate flags)
• just push full workspace cargo nextest run --workspace — 6916 passed, 18 skipped, 0 failed
• aionui-team integration suite (105 tests) covers: leader-only first start, lazy wakeup happy path, preserved-unread failure with blocked_reason=runtime_failed, source-gated leader notify (agent-triggered notifies / human-direct does not), Ready gating (Absent does not block / Attaching blocks), reconciliation skipping dormant, the per-member attach route (wake dormant / cross-user Forbidden / unknown-slot AgentNotFound), and team.slotWorkChanged payload shape.

Coverage gap for reviewers: the attach route's service-level cross-user Forbidden and unknown-slot AgentNotFound are asserted, but an HTTP-layer 401 (unauthenticated) and missing/invalid-CSRF assertion is not explicit (it relies on the shared team router middleware). An app-layer HTTP security assertion is worth adding.

Notes

Backend correctness hinges on ordering: ensure_member_runtime_lazy does the synchronous reserve_attach before the background spawn, and resolves service/published-session first to avoid a dangling Attaching lease. This is a hard-to-observe path, hence the info-level boundary logs.

Related PR

Frontend companion: iOfficeAI/AionUi#3712