feat: add durable device mailbox with unified delivery fallback

[Disdjj]

Summary

• add an encrypted, pull-only durable mailbox with CAS-backed operation state, leases, cancellation, expiry, credential revalidation, and a device-side durable journal
• let normal command invocations select ~delivery: realtime | mailbox | fallback; fallback queues only when the host proves the realtime call was not_dispatched
• expose the same single-call contract through the SDK, tb call, Dashboard, and MCP while keeping existing realtime Device SDK integrations unchanged
• add operation management and device claim/renew/complete surfaces for both Node and Cloudflare hosts

Safety and compatibility

• completed includes device business errors and never falls back to mailbox
• unknown means the call may have reached the device; it is returned as non-retryable and is never automatically queued
• existing commands default to realtime, so current Device SDK integrations do not need to change
• mailbox-capable commands opt in with delivery: mailbox | both and consume work through createDeviceMailboxProcessor plus a durable journal
• mailbox requires TB_SECRET_ENCRYPTION_KEY; this is at-rest encryption with a separately derived mailbox subkey, not end-to-end encryption
• one active installation per deviceId remains the MVP idempotency prerequisite

Public package versions

• @tool-bridge/app 0.19.0
• @tool-bridge/cli 0.29.0
• @tool-bridge/dashboard 0.26.0
• @tool-bridge/gateway 0.24.0
• @tool-bridge/sdk 0.20.0
• @tool-bridge/server 0.20.0

Tags must be created one at a time from main after merge.

Validation

• pnpm verify
• pnpm turbo run build
• npx -y @tokenroll/llmdoc validate
• git diff --check

Closes #117