fix(connectors): persist connector_runtime_turn_id so cache eviction can't lose it

[yiboyasss]

Summary

Stacked on xorbitsai#2110 (PR 1: ephemeral connector secret TTL/renewal). This slice is the identity-persistence half of the same secret-lifecycle work: do not merge into main yet — this targets xorbitsai#2110's branch and will be retargeted to xorbitsai/xagent:main once xorbitsai#2110 merges, so the diff shown here only covers this PR's own change, not xorbitsai#2110's.

The turn id that owns a run's ephemeral connector secrets previously lived only in the cached AgentService's tool_config. A resume rebuild after a cache eviction (idle reclamation, capacity eviction, a scope-fingerprint mismatch) never re-supplied it — every resume path (websocket explicit/message-triggered resume, v1 reply, A2A, the channel bots) omits connector_runtime_turn_id when calling get_agent_for_task. The rebuilt tool_config then looked up ephemeral secrets under None, even though a still-live turn's secrets were sitting in connector_runtime.py's process-local store, addressable only by the id the original CREATE/APPEND claim minted.

• New nullable tasks.connector_runtime_turn_id column (migration 20260904_add_connector_runtime_turn_id_to_tasks), no index — read alongside the row it belongs to, never queried by value.
• Written in the same UPDATE that mints run_id (task_orchestrator._claim_turn_no_commit), so the two can never disagree about which run a turn belongs to. An APPEND claim's own new turn_id overwrites the prior, now-finished turn's value.
• get_agent_for_task falls back to the persisted value when a caller passes none, without overriding an explicit one from the normal execution path (which always knows its own live turn_id).

Test plan

• Migration: add/remove idempotent, no-ops without a tasks table, historical rows read back as NULL (tests/alembic/), plus the full sqlite migration-chain integration suite
• Write side: CREATE and APPEND each persist their own turn's id; APPEND overwrites CREATE's (tests/web/api/v1/test_tasks.py)
• Read side: omitted turn_id falls back to the persisted one; an explicit turn_id is never overridden; a NULL persisted value doesn't sync a literal None onto the tool config (tests/web/api/test_get_agent_for_task_connector_runtime_turn_id_fallback.py)
• Every new test cp-backup verified (fails without the fix)
• Broad regression sweep (tests/web/api, orchestrator/snapshot/connector-runtime tests) green; only pre-existing, unrelated flakes
• ruff / mypy / isort clean; alembic-check verified directly (single head, correct down_revision) since the pre-commit hook's own uv-provisioned venv couldn't build onnxruntime for this machine's Python