feat(status): expose authoritative workflow events

[jonwinton]

Summary

Replace runner-specific timing and inferred progress with one lifecycle contract owned by status.Tracker.

• Tracker.Do(ctx, state, fn) brackets every real migration, move, and datasync attempt and emits synchronous started/finished events.
• Observers receive explicit durable-mutation and terminal-ownership evidence independently from phase completion.
• Copy completion reports settled rows and chunks once from authoritative copier counters.
• Result-bearing forward-cutover callbacks preserve mutation truth even when a later error is returned.
• Ambiguous direct DDL, cutover callbacks, source renames, and reverse renames stop retrying and require manual ownership recovery.
• Reverse-window ownership is persisted so resumed runs retain authoritative terminal and durable-mutation semantics.
• Retry accounting returns committed rows rather than the final rolled-back attempt.

Observers are optional. With no observer attached, runners retain their existing behavior and do not query completed-work totals. The tracker remains zero-value ready; observer delivery is synchronous and panic-isolated, and callback state is copied before invocation so observers can safely replace or remove themselves.

Design

This deliberately does not add a second workflow engine beside Spirit's status machine. status.Tracker remains the sole source of current state and timing; observation is a thin view of transitions and durable facts. Terminal evidence has its own event because reverse-finalized or ownership-ambiguous outcomes can be established after the final phase bracket closes.

Mutation and ownership ambiguity remain distinct facts. A result can require manual recovery without claiming that a durable write was confirmed.

Verification

• go test -race -count=1 ./pkg/status
• MYSQL_DSN=msandbox:msandbox@tcp(127.0.0.1:8033)/test go test -race -count=1 ./pkg/migration
• MYSQL_DSN=msandbox:msandbox@tcp(127.0.0.1:8033)/test go test -race -count=1 ./pkg/move
• go build ./...
• go vet ./...

Supersedes the observer/lifecycle approach in #1111 and the runner-local timing design merged in #1118. It also consolidates the correctness slices previously proposed in #1112 through #1116.