Add push-based agent automations

[fmhall]

Summary

• add push-based one-time, daily/weekday/weekly, and interval automations backed by Vercel Workflow durable sleeps instead of a minute dispatcher
• add authenticated Gmail users.watch + Pub/Sub triggers with durable history cursors, watch renewal, sender/thread/subject filters, and per-message deduplication
• run every trigger in a fresh, replay-stable Eve session, collect and log the full event stream, retire the execution session, and deliver the result through Linq with a stable idempotency key
• add create/list/pause/resume/delete tooling and block automation-authenticated tasks from mutating the automation control plane
• persist revisioned automation state, run outcomes, execution session IDs, Gmail watch state, and full failures; pause/delete wins over in-flight completion

Setup and behavior

Gmail automations require a Pub/Sub topic in the Google OAuth project, Gmail publisher access on that topic, and an OIDC-authenticated push subscription targeting /api/automations/gmail. The required GMAIL_PUBSUB_* values and setup are documented in the README. Missing configuration fails Gmail automation creation instead of falling back to polling.

Automation execution and delivery logs intentionally retain complete inputs, outputs, event streams, provider errors, and user identifiers for debugging, matching the current no-redaction policy.

Validation

• pnpm check (52 test files, 239 tests; lint, types, formatting, Knip, and boundaries)
• pnpm db:check
• pnpm build:eve
• pnpm build
• git diff --check
• local five-second timer smoke: armed with HTTP 200, woke after durable sleep, created one fresh operation-owned Eve session, received the exact model response, collected the full stream, retired the session, and persisted the final run. Local Linq delivery then followed the expected retry/failure path because LINQ_CONNECTOR was intentionally absent.

Review notes

• the core review path is trigger/schema → transactional automation service → durable workflows/routes → agent-facing tools
• Drizzle generated 0006 for the three new tables and 0007 for the persisted Eve execution session added during race remediation
• Workflow SDK is pinned to 5.0.0-beta.43, matching Eve's current Workflow generation