CUST-WP-0074-T02: task wait qualifiers in the hub read model

Adds tasks.decision_id and workplan_dependencies.from_task_id (migration
e8f9a0b1c2d3). A from_task_id column is needed rather than
from_workplan_id plus description: the partial unique indexes key on
(from_workplan_id, target, relationship_type), so two tasks in one
workplan waiting on the same target could not both be indexed, and the
derived wait_kind needs per-task attribution. The two existing unique
indexes are narrowed to frontmatter edges (from_task_id IS NULL) and two
task-origin counterparts are added; downgrade deletes task-origin rows
before restoring the old indexes.

POST /workplans/{id}/dependencies/ accepts from_task_id (must belong to
the from workplan; a task cannot depend on itself). TaskCreate/Update/Read
carry decision_id.

Derived read-model fields, no new write routes (rule 5):
- TaskRead.wait_kind: external | human | both | unqualified, null unless
  status is wait (dependency rows from this task / needs_human).
- WorkplanRead.blocked_kind: human | external | none, null unless status
  is blocked. Human wins over external.
Both come from api/services/wait_kind.py, applied on GET /tasks/,
GET /tasks/{id}, GET /workplans/ and GET /workplans/{id}.

The identifier-migration reference-count proof now includes from_task_id
(FK count guard 22 -> 23).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 237582@bnt-lap001
Assistant-Session: f2b3d9f1-8fb9-4b9c-bc2b-837ec5dfc826

api/routers/workstreams.py

@@ -24,6 +24,7 @@ from api.schemas.workplan import (
 )
 from api.services.lifecycle import transition_workplan_status
 from api.services.legacy_compat import retire_legacy_route
+from api.services.wait_kind import annotate_workplans
 from api.work_record_flavor import (
     RESIDUAL_FLAVOR,
     WORK_RECORD_FLAVORS,
@@ -389,7 +390,7 @@ async def list_workplans(
     include_residuals: bool = Query(True),
     session: AsyncSession = Depends(get_session),
 ) -> list[Workplan]:
-    return await _list_workplans(
+    workplans = await _list_workplans(
         topic_id=topic_id,
         repo_id=repo_id,
         repo_goal_id=repo_goal_id,
@@ -400,6 +401,7 @@ async def list_workplans(
         include_residuals=include_residuals,
         session=session,
     )
+    return list(await annotate_workplans(session, workplans))
 
 
 @router.get("/workplan-index", status_code=status.HTTP_410_GONE)
@@ -499,7 +501,9 @@ async def get_workplan(
     workplan_id: uuid.UUID,
     session: AsyncSession = Depends(get_session),
 ) -> Workplan:
-    return await _get_workplan(workplan_id=workplan_id, session=session)
+    wp = await _get_workplan(workplan_id=workplan_id, session=session)
+    await annotate_workplans(session, [wp])
+    return wp
 
 
 @router.patch("/{workstream_id}", status_code=status.HTTP_410_GONE)