Unify pull operations and push tasks on one WorkItem entity in core

Supersedes the original approach on this issue (projecting resolved candidates onto the token), which would have created a second candidacy projection alongside the inbox's WorkItem. Instead, unify the two human-work models on one entity.

Background

A human node comes in two forms that differ only in how the pending work is shown: a push task (the inbox, which mints a WorkItem carrying the resolved candidate tokens, indexed and queryable) and a pull operation (the My actions list, UserOperation, which mints no work item and is resolved live from the parked token on every view). The pull surface therefore scans every parked token in the tenant, unpaged and uncached, which is the PERF-3 finding. The two forms are already parallel class pairs (UserTask and UserOperation, CommentTask and CommentOperation, InteractionTask and InteractionOperation) that differ almost entirely in push-versus-pull presentation.

Proposed change

• Move the WorkItem entity, its interface, its manager (creation, candidacy, claim, assign, reassign, completion) and its storage schema from orchestra_inbox into core. The manager already depends only on core services, so the move is clean. orchestra_inbox keeps only the UI (routes, forms, controllers, views).
• Add a mode field to WorkItem (task or operation). It drives presentation only: the inbox is the push view, My actions is the pull view. My actions keeps listing everything the viewer can act on (both modes), so the finder query stays candidates IN (viewer tokens) with no mode filter and rides the existing candidates index; no new index is required for it.
• Mint the WorkItem generically at the engine park step for any human node, so UserOperation gains a work item (its subclasses inherit it) and the pull and push paths share one creation path. The mode is taken from the task type.
• Rewrite the pending-actions finder to a paged, index-served WorkItem query, replacing the tenant-wide parked-token scan and its uncached render. This closes PERF-3.

Phasing

1. Relocate WorkItem and its lifecycle to core with no behavior change; the inbox consumes the core manager.
2. Add the mode field and the generic park-step creation for every human node.
3. Rewrite the finder to the paged WorkItem query and drop the uncached render.
4. Live migration (the entity's provider changes from orchestra_inbox to core) and a one-time backfill of work items for currently parked operation tokens.