feat: reconcile granted ops run closes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf

migrations/versions/0010_add_repository_grant_and_close_identity.py

@@ -0,0 +1,42 @@
+"""add repository grant and terminal close identity
+
+Revision ID: 0010
+Revises: 0009
+Create Date: 2026-09-04
+
+ACTIVITY-WP-0037 — authoritative repository-grant carriage and exact terminal
+close reconciliation. Both columns are additive so legacy and open rows remain
+valid; pre-migration terminal rows deliberately cannot claim exact-repeat
+reconciliation because they have no accepted intent digest.
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "0010"
+down_revision: str | Sequence[str] | None = "0009"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "ops_runs",
+        sa.Column(
+            "repository_grant",
+            postgresql.JSONB(astext_type=sa.Text()),
+            nullable=True,
+        ),
+    )
+    op.add_column(
+        "ops_runs",
+        sa.Column("close_intent_digest", sa.Text(), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("ops_runs", "close_intent_digest")
+    op.drop_column("ops_runs", "repository_grant")