feat(durable): zeph durable CLI, config wiring, init wizard, migrate-config, TUI view

[bug-ops]

Implements C6 of the durable execution epic (#4707, spec-064): the mandatory user-facing integration points. No execution semantics change — this makes the durable layer reachable and operable.

Closes #4949

What

Surface	Change
Config	Pure-data DurableConfig/RetentionPolicy/DurableBackend moved to zeph-config (single source of truth, re-exported by zeph-durable); Config.durable field added; encryption_gate is now a free function. Avoids pulling zeph-db/sqlx into the 12 leaf crates that depend on zeph-config without it.
CLI	zeph durable list/show/inspect/prune/resume — connects directly to durable.db, no agent process (FR-DE-08). Redacted by default (INV-5); --reveal decrypts via the vault ZEPH_DURABLE_KEY (FR-DE-07). New LocalBackend read APIs: list_executions, read_execution_redacted, count_prunable; ExecutionId::parse_str.
migrate-config	Idempotent, additive [durable] step (default-off) + section in config/default.toml.
--init	Wizard step (enable/backend/retention); generates and stores ZEPH_DURABLE_KEY in the age vault, never inline in TOML.
TUI	DurableView panel (D key, durable palette entry, Tab cycle) with the spec-011 status spinners, fed by a read-only background poll task.

Config placement decision

The pure-data config types moved to zeph-config (like OrchestrationConfig) rather than adding a zeph-config -> zeph-durable dependency (which would force zeph-db/sqlx onto 12 leaf crates) or duplicating the struct. zeph-durable depends on zeph-config and re-exports them, so zeph_durable::DurableConfig still resolves and the engine APIs consume the same type the root Config holds — no duplication, no conversion. The AEAD policy (EncryptionGate + encryption_gate) stays in zeph-durable next to the cipher and error type. The spec module layout (spec-064) was updated to record this.

Docs & test artifacts

• book/src/reference/cli.md, configuration.md, security/durable-encryption.md (base64 key encoding + rotation policy).
• Playbook durable.md C6 section (6 scenarios) and 6 coverage-status.md rows (in .local/testing, project-shared).
• CHANGELOG.md [Unreleased].

Checks (CI feature set desktop,ide,server,chat,pdf,scheduler)

• cargo +nightly fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest --workspace --lib --bins -> 10920 passed, 22 skipped
• cargo doc --no-deps (deny broken_intra_doc_links)
• cargo test --doc -> 10 passed
• RUSTFLAGS="-D warnings" cargo check --workspace --all-targets --locked

Notes

• The P1 agent-loop adapter (A1 feat(tools): durable agent tool-loop steps with crash-resume (P1) #4951) is out of scope and remains blocked on the LLM-serialization live-API gate; [durable].agent_turns has no effect until it lands.
• LLM-serialization gate is N/A — this PR touches no LLM request/response path.