feat: bind job events to command leases

proto/archive_control/v1/control.proto

@@ -38,6 +38,17 @@ message RequestJobSnapshotCommand {
   repeated string job_ids = 1;
 }
 
+// ReconcileJobCommand makes control's durable cursor authoritative after a
+// reconnect conflict, local database restore, or rejected stale event. The
+// client must durably adopt this cursor before acknowledging the command and
+// must never emit output for superseded_command_ids afterwards.
+message ReconcileJobCommand {
+  JobRecord authoritative_job = 1;
+  uint64 authoritative_last_event_sequence = 2;
+  repeated string superseded_command_ids = 3;
+  string reason = 4;
+}
+
 message Command {
   string command_id = 1;
   google.protobuf.Timestamp created_at = 2;
@@ -48,6 +59,7 @@ message Command {
     EnsureRouteCommand ensure_route = 13;
     InventoryQuery inventory_query = 14;
     RequestJobSnapshotCommand request_job_snapshot = 15;
+    ReconcileJobCommand reconcile_job = 16;
   }
 }
 
@@ -97,6 +109,10 @@ message JobEvent {
   ResourceStateFingerprint observed_resource = 10;
   Placement observed_placement = 11;
   google.protobuf.Timestamp occurred_at = 12;
+  // The durable ExecuteStepCommand or CancelJobCommand that owns this event.
+  // Control verifies this ID, the reporting client, the command's expected
+  // cursor, and the permitted step/state transition before appending it.
+  string command_id = 13;
 }
 
 message JobSnapshot {