feat(orchestrator): goal-level coordination step (P2-ii-a) - #1128

...s children and apply a per-child action plan (P2-ii-a)
Wires the P2-i coordination kernel into a live goal-level step. A "goal" is a
top-level task that has children (the broker has no goal/epic struct — children
carry ParentIssueID); when one becomes executable, the broker coordinates its
children instead of dispatching the parent as a single agent turn.
Wire shape (new): CoordinateRequest{schema_version, goal_id, children[]} ->
CoordinationPlan{goal_id, actions{task_id->action}, ready[], cycle?}. extra="forbid"
+ server-side schema_version validation, matching the P2-0 contract discipline.
Orchestrator (Python):
- coordination.py `coordinate(graph)` -> CoordinationResult: per-child action,
 the ready batch, and a cycle path. A dependency cycle is a deadlocked
 decomposition: every child BLOCKs and the path is surfaced so the broker fails
 loud rather than running an unrunnable plan.
- service.py `POST /coordinate`: pure (no harness, no checkpointer) over
 TaskGraph.from_broker_records.
Broker (Go) — rides the existing dispatch loop (the chosen trigger):
- sendTaskUpdate routes a goal (taskIsGoal: top-level + has children) to
 coordinateGoalViaOrchestrator; a leaf still takes the single-task /run path.
- coordinateGoalViaOrchestrator enumerates children and sends
 depends_on = DependsOn ∪ BlockedOn, so the kernel's release rule matches the
 broker's unblock cascade (which sweeps both — orchestratorRecord omits them).
- applyCoordinationPlan: START -> TransitionLifecycle(running) (the notify loop
 dispatches it next tick); DISPATCH -> single-task /run now; BLOCK/IDLE/AWAIT ->
 leave; UNKNOWN/cycle -> fail loud, act on nothing. Per-goal single-flight in a
 key space distinct from per-task dispatch; panic-recover + shutdown-aware ctx
 reuse the P2-0 guards.
- provider.DispatchClient.Coordinate over POST /coordinate; postStep refactored to
 share postRaw with the new endpoint.
Tests: pytest +coordinate cases (serial/parallel/cycle/rejected-upstream + the
endpoint); Go provider Coordinate decode/validation/cycle; broker apply-plan,
union-deps, cycle-does-nothing, taskIsGoal; a real-client /coordinate E2E through
the broker. Live smoke adds a /coordinate assertion. pytest green; go vet +
golangci-lint clean; team/provider suites green under -race (except the
pre-existing env-only TestBrokerAuthRejectsUnauthenticated — gbrain on PATH).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>