feat(workflow): land the background job runtime and fix three reliability holes

[Luhaozhu]

What

Workflow mode already registered the run_job tool and shipped its prompts, but the runtime
behind it was never wired up in this repository:

• jobs / internal_jobs were missing from the router registry — the sandbox callback endpoint
  did not exist;
• Job / JobItem / JobCall were missing from the model exports, so anything importing them
  raised ImportError;
• no migration created the jobs / job_items / job_calls tables.

Submitting a job therefore failed at the first ledger write. This PR lands the runtime together
with the reliability fixes it needs.

Fixes

Problem	Fix
A job blocked the whole conversation until it finished	run_job(wait=...) defaults to false; the tool returns the job id immediately and the session is woken on progress and completion
The runner died on its first callback (Name or service not known) because the callback base URL was hard-coded to host.docker.internal	The base URL is probed from inside the sandbox across candidates (in-network service name → nginx /api → host alias); if none answer, the job refuses to start with an actionable error instead of hanging in pending
A job whose driver coroutine died stayed pending/running forever — every guardrail lives on that coroutine — and blocked new jobs in the same chat	A periodic reaper marks such jobs interrupted (cross-process evidence: no in-process driver and a silent ledger past its window) so they can be resumed
A brand-new job displayed as "running for 8 hours"	Job timestamps default to timezone-aware UTC; a naive datetime.utcnow written into TIMESTAMP(timezone=True) is reinterpreted in the session timezone, shifting every row by the container's UTC offset
A failing job silently vanished from the status strip	The strip names the current phase while the ledger is empty and keeps a dismissible line with the reason when a job ends badly

Verification

• New regression tests: the reaper's three verdicts (reap / leave alone / never touch a job with
  a live driver), the callback probe's branches (explicit env wins, probe picks a reachable base,
  nothing reachable refuses to start), and the timezone-aware column defaults.
• Router registry, model exports, migration chain and job table creation were checked to be
  mutually consistent — the exact class of half-landed wiring this PR repairs.