feat(mvp): Phase 1 control layer + API vertical slice

Implements the Phase 1 MVP from the README: a stateless control layer + HTTP
API over a centralized database, with hook-enforced test/push gates.

- DB layer: SQLAlchemy Core, one schema rendering both Postgres (BIGSERIAL /
  TIMESTAMPTZ / JSONB) and SQLite (INTEGER PK / TEXT / JSON) via portable types;
  native ON CONFLICT DO UPDATE checkmark upsert on both dialects.
- Alembic dual-dialect migrations (render_as_batch for SQLite); tests run a real
  `alembic upgrade head`.
- FastAPI: projects/agents/checkmark/log/answer/resume + shared log/context
  routes, single global bearer token, higher-trust token gating shared-context
  writes, project isolation on every route.
- Hooks (`python -m handler.hooks <event>`): Stop test gate (block on red),
  PreToolUse AskUserQuestion defer + `git push` gate (tests then throwaway
  build), Notification generic webhook (no-op without WEBHOOK_URL). Identity via
  env injected at spawn; verify is the mock seam.
- Control CLI: spawn/list/attach/kill, hard `.mise.toml [tasks.test]` gate,
  generated per-agent settings.json, identity + DATABASE_URL injected via tmux;
  tmux is the mock seam.
- 45 tests (SQLite), ruff clean. Live claude/tmux/mise spawning deferred behind
  the mocked seams.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W5ZuS5pV1NS6eKsRZHXonY

tests/test_db_upsert.py

@@ -0,0 +1,52 @@
+"""The highest-value DB test: the checkmark upsert overwrites in place (ON CONFLICT DO
+UPDATE), keeping a single row with preserved identity — never delete+reinsert.
+"""
+
+from __future__ import annotations
+
+from sqlalchemy import func, select
+
+from handler.db import repository as repo
+from handler.db.tables import checkmarks
+
+
+def _seed_agent(conn):
+    repo.create_project(conn, "p", "/tmp/p")
+    return repo.create_agent(conn, "p", "a", "/tmp/p/a")
+
+
+def test_upsert_overwrites_single_row(conn):
+    agent = _seed_agent(conn)
+
+    repo.upsert_checkmark_row(
+        conn,
+        agent["id"],
+        status="working",
+        where_it_stopped="first stop",
+        tests_status="unknown",
+    )
+    repo.upsert_checkmark_row(
+        conn,
+        agent["id"],
+        status="done",
+        where_it_stopped="second stop",
+        tests_status="pass",
+    )
+
+    count = conn.execute(select(func.count()).select_from(checkmarks)).scalar_one()
+    assert count == 1
+
+    row = repo.get_checkmark(conn, agent["id"])
+    assert row["status"] == "done"
+    assert row["where_it_stopped"] == "second stop"
+    assert row["tests_status"] == "pass"
+    assert row["agent_id"] == agent["id"]
+
+
+def test_upsert_only_touches_supplied_columns_via_defaults(conn):
+    agent = _seed_agent(conn)
+    repo.upsert_checkmark_row(conn, agent["id"], status="working")
+    row = repo.get_checkmark(conn, agent["id"])
+    # Unsupplied gate columns fall back to their schema defaults.
+    assert row["tests_status"] == "unknown"
+    assert row["build_status"] == "unknown"