fix(workbook): refresh only the stale cells in each row

[rudycelekli]

What & why

Standing refresh identifies rows with stale enrichment fields but currently submits those rows to an unrestricted workbook run. If only one field has expired, fresh AI results can be replaced and an unrelated output column can be dispatched.

Keep the exact stale field IDs for each row and pass that matrix through the existing runner scope. Refresh remains limited to enrichment, waterfall and AI formula columns. Source materialization, existing TTL/status rules, workspace scope and activity reporting are preserved.

This is separate from #69's recurring-job scheduling and #73's configured output dependencies. It changes standing refresh selection, not explicit user-selected workbook runs.

Type

• Bug fix
• New feature
• New enrichment provider / source
• Docs
• Refactor / chore

Verification

Six regression cases execute the real refresh/runner/ORM boundary with two persisted rows that have different stale fields. They cover linked and unlinked identities, expired and failed fields, preservation of fresh values, no output dispatch, a second refresh and all-fresh no-op controls. External AI and Sheets calls are stubbed; these tests do not claim live provider delivery.

The frozen tests on unchanged main fail four cases and pass two controls: the old runner performs four AI calls instead of two and reaches Sheets twice. With this patch, the focused regression and adjacent refresh-row, cell-scope and dependency suites pass all 64 tests locally.

Canonical unchanged full CI on the exact signed head: https://github.com/rudycelekli/OpenGTM/actions/runs/38064838190 (all four jobs passed on the exact signed candidate).

Checklist

• Commits are signed off (git commit -s) per the DCO
• Backend tests pass — unchanged frozen SQLite and PostgreSQL CI
• Monorepo lint and build pass — unchanged canonical CI
• I did not add scraping of paywalled / pirated / login-gated content
• Credentialed providers are opt-in and inert by default

Security-sensitive?

This changes which existing LLM/enrichment and outbound output calls standing refresh selects. It prevents unrelated output columns from being scheduled by that refresh path. Existing credential, URL, auth, tenancy, dependency and output run-once guards are unchanged. No vulnerability disclosure or new transport is included.

Notes

AI-assisted implementation and tests; reproduction, scope, diff and native controls reviewed independently. No public API, schema, dependency or CI workflow changes.

Root independently reran all 64 focused tests. The canonical owned run passes 2,098 SQLite tests (134 existing skips), 18 PostgreSQL tests, 63 frontend tests and three mounted Chromium regressions. These checks cover the candidate before publication; upstream checks may still be pending after submission.