🤖 refactor: split createUnderTaskTreeLifecycleLock, part 2: launch failure (#7703)

## Summary

Part 2 of 5: splits the launch-failure path (the `failLaunch` closure)
of `TaskService.createUnderTaskTreeLifecycleLock` in place, with no
behaviour change. The method drops from CC 113 to CC 88. On top of part
1. 442 changed lines.

## Steps in this part

- `failTaskLaunch` takes the rollback options as an argument, because
its three call sites pass different options.
- `isLiveUnderLaunchAttempt` checks whether anything still runs under
the launch attempt.
- `endPublishedTaskLaunchFailure` writes the row marker as a CAS. When
it fails, it logs and returns, with no settlement.
- `stopFailedTaskLaunch`, `settleFailedTaskLaunch` and
`finishTaskLaunchFailure` handle the rest of the failure.
- The mutable `TaskLaunchState` record holds `materializedCheckout`,
`attemptId`, `launchAttempt` and `sendAdmitted`. Those values are
written after the record exists, and `failTaskLaunch` reads them.
`failTaskLaunch` reads `launchAttempt` once when it starts, and nothing
writes it during the failure path.
- The stop cascade inside the failure path still runs Phase A directly.
That is correct, because this method already holds the global mutex.

## Rules every part keeps

- The method keeps `await using _lock = await this.mutex.acquire()`.
Inside that scope, a bare `return promise` releases the global mutex
before the promise settles. So every call from the method to a step is
`await` or `return await`, and no step acquires the mutex, which is not
reentrant.
- The steps form a chain: each step calls the next one directly after
its own last await. So no collaborator call runs a microtask later than
in the inline code. Only the result of the method resolves later, at
approximately 2 microtasks per chain level. The mutex therefore releases
that much later, at the same logical point.
- `make crap-check` against the parent commit reports 0 violations, with
and without coverage. Every new function scores CC 8 or less.
- `bun test` on the taskService, ledger, workspaceTurnManager,
workflows, tools and workspaceService suites: 4,968 pass, 0 fail. These
suites include the 27 tests from #7701.

---

_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking:
`high` • Cost: `$182.90`_

<!-- mux-attribution: model=anthropic:claude-opus-5-5 thinking=high
costs=182.90 -->

Author: ThomasK33