collab: phase-3 committer — debounced commits via files/apply (#86)

[hevayo]

Implementation issue for #86 phase 3, revised for the no-worktree architecture (grilled 2026-07-08). Lands on feature-collab-with-agents.

Decisions

1. Every flush is a commit through the existing POST /projects/{p}/files/apply — git stays aep-api's monopoly; the collab server only decides when and what. No new aep-api surface. Rationale: uncommitted volume files are invisible to every other reader (agent turns pin commit-sha snapshots; the Files API / tags read git HEAD) — the only save others can see is a commit.
2. Cadence (Hocuspocus onStoreDocument built-ins): ~60s quiet debounce, ~5min cap during continuous editing, and the final store when the last participant leaves (before unload). Crash loses at most the debounce window; recovery = reseed from HEAD.
3. Only changed files (doc snapshot vs a per-room baseline of seeded/last-applied content+shas), with per-file baseSha preconditions; new files ride the empty-baseSha must-not-exist arm; vanished non-md paths become DeleteOps (md deletion deferred — top-level fragments can only empty).
4. Attribution (Collaborative spec editing — Yjs collab service, agents as live peers, git as durable projection #86 d9): apply's bot author/committer + Co-authored-by: trailers in the message for the session's participants (identities captured at room auth).
5. Auth: the most recent participant's JWT, retained per room — the same request-scoped model as seeding/validate.
6. Conflicts (409): doc wins — refetch current shas, re-apply, bounded retries (Collaborative spec editing — Yjs collab service, agents as live peers, git as durable projection #86 d6 spirit).
7. Deferred: external-change merge (webhook → live doc) stays a Collaborative spec editing — Yjs collab service, agents as live peers, git as durable projection #86 line item; the uncommitted-persistence tier question is parked in its own design issue.

Related: #86 (phases), #113 (files/apply), #130 (chat panel triggers the sessions this persists).

[hevayo]

Built and verified live — commit 2c0796b on feature-collab-with-agents. Typed into a real room → the edit reached git HEAD after the debounce; closed the last tab → immediate session-end flush; the GitHub commit message carries the participants' Co-authored-by: trailers (with the noreply fallback — Thunder access tokens carry no email claim, same convention as genai's author identity). Doc-wins conflict retry, baseline advance, delete ops, and the fallback are pinned by 7 new unit tests (32 total green). Cadence is env-tunable (COLLAB_COMMIT_DEBOUNCE_MS/COLLAB_COMMIT_MAX_DEBOUNCE_MS, compose defaults 60s/5min). Closing when the feature branch integrates.