design: durable cross-request state (State ADR) #209

Stub so in-flight design docs have something to point at; real scoping happens in the epics pass.

Multiple workstreams now need the same decision: where durable state that outlives a request (and eventually a pod) lives, and what the checkpoint/resume contract looks like.

Known dependents so far:

• HITL dual-channel ADR (branch mshearer/adr-hitl-dual-channel): durable park-and-resume and multi-pod decision routing wait on this decision. HITL approval gates for MCP tool calls #191 (bind approval to the exact call, spend it exactly once) also needs the decision record to survive restarts. Current boundary: the config gate and orchestration park approvals in-process, alive only as long as the SSE stream; the client-tool approval path and the webhook round-trip hold no server-side state.
• Unbounded coordinator context on long orchestration runs. The fix is not settled, but any version of it that persists working state across requests lands on this decision.
• A2A TaskState::InputRequired wiring.