feat(goal-run): add multi-checkpoint goal orchestration with H5 and admin surfaces.

Persist goal runs in MySQL, bind agent runs to checkpoints, expose awaiting-approval
UX in chat, and add admin inspection routes with local verify scripts.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/goal-run-verify-lib.mjs

@@ -0,0 +1,37 @@
+export function parseCanaryUserIds(raw = process.env.GOAL_RUN_CANARY_USER_IDS) {
+  return String(raw ?? '')
+    .split(/[,;\s]+/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+export async function resolveCanaryVerifyUser(pool, {
+  usernameFallback = process.env.VERIFY_GOAL_RUN_USER
+    ?? process.env.VERIFY_LLM_ROUTER_USER
+    ?? 'john2',
+} = {}) {
+  const canaryIds = parseCanaryUserIds();
+  const preferredId = canaryIds[0] ?? null;
+  if (preferredId) {
+    const [rows] = await pool.query(
+      'SELECT id, username FROM h5_users WHERE id = ? LIMIT 1',
+      [preferredId],
+    );
+    if (rows[0]?.id) {
+      return {
+        userId: String(rows[0].id),
+        username: String(rows[0].username ?? usernameFallback),
+      };
+    }
+  }
+
+  const [rows] = await pool.query(
+    'SELECT id, username FROM h5_users WHERE username = ? LIMIT 1',
+    [usernameFallback],
+  );
+  if (!rows[0]?.id) return null;
+  return {
+    userId: String(rows[0].id),
+    username: String(rows[0].username ?? usernameFallback),
+  };
+}