Define and enforce cross-aggregate cascade rules

[rororowyourboat]

Context

From the system design audit, cross-aggregate consistency rules are incomplete. The spec now resolves these but the codebase should enforce them explicitly.

Key Rules (from spec)

Trigger	Cascade	Atomicity
client.delete	client.deleted + N x project.client-unassigned	Single decider invocation, all events in one batch
thread.delete	thread.deleted only. Session NOT auto-stopped	Single event
thread.project.reassign (hot)	thread.project-reassigned. Active session/turn/approvals continue	Single event
Checkpoint trim (500 cap)	Projection record removed. Diff blob deleted. Git ref retained	Projection update

Specific Gaps to Address

1. client.delete cascade: Already implemented. Verify test coverage for cascading unassign with N projects.
2. thread.delete + active session: Document that session is NOT auto-stopped. Add test: delete thread with active session -> verify session still runs (or explicit stop required first).
3. Hot reassignment: Already implemented (no quiescence check). Document that this is intentional. Add test: reassign thread mid-turn -> verify turn completes successfully.
4. Checkpoint trim cleanup: See companion issue for diff blob cleanup.

Acceptance Criteria

• All cascade rules from the table above have test coverage
• Hot reassignment during active turn is tested
• thread.delete behavior with active session is documented and tested
• Cascade rules documented in code comments near decider logic

References

• System Design Spec: .plans/21-system-design-spec.md Section 5 (Cascading Behaviors)
• Audit finding: "Cross-aggregate consistency rules are incomplete"

[rororowyourboat]

Implemented in decider guards commit — cascade rules documented at all cascade points in decider.ts