backend-agents F21: persisted backend submit queue + drain

[btipling]

Parent: #794
Umbrella: #794
Label: backend-agents
Status: DRAFT
Blocked on: #814 (E20)

Implements one row of the restart umbrella. One issue → one PR → one adversarial review → one merge → close. Do not expand scope.

Slice

Enqueue child prompt runs (one child workflow = one prompt, never one tool). Drain via the durable start surface.

inv_queued_count parity + Wasm promote gate stay. Additive, fail-closed.

Architecture lock (from #794 — copy, do not weaken)

SDK: 'use step' is only callable from 'use workflow', never from inside another step. Wrapping runAgentStream / streamText+execute in one step is forbidden.

Required loop (workflow context):

"use workflow"
messages = [user]  # reconstructed on replay from step deltas
while not done and rounds < cap:
  gen = await modelGenerateStep(delta)         # ONE LLM round; schemas only, no execute
  write SSE
  if no toolCalls: break
  for call in gen.toolCalls:
    result = await toolExecuteStep(call, freshnessDelta)  # ONE tool; re-resolve
    write SSE
    messages.push(result)
await persistStep(...)

• One run = one prompt. One step = one model round or one tool or one persist.
• Step I/O = deltas, never the full transcript. Tokens = getWritable(). Transcript + checkpoint = Blob.
• turnRunId = Workflow run.runId, never sessionId.
• Tool business errors are return values, not throws.
• 'use workflow' file must not statically import db/mcp/blob/node:crypto/node:dns.
• Child workflows = queued prompts only, never per tool.

DoD

• Queue persists prompts, one child run each
• Drain uses the durable start surface
• inv_queued_count parity; Wasm promote gate unchanged
• typecheck + full vitest green
• No Wasm/protocol change

Refs

• Parent/umbrella: plan: backend-agents RESTART — client-independent turns (umbrella, ≥20 small issues + handoff) #794