fix(executor): load permission config once per run and retry transient reads - #7847

Summary

• Every block runs on a shallow copy of the execution context, so the permission-config memo written onto it was thrown away and the full permission-group config (workspace, org owner, billing state, subscription, group) reloaded from the database before every block
• Memoize the in-flight load in a run-scoped map shared by every block copy, keyed by governed subject + workspace. Parallel branches share one load, failed loads are evicted, child workflows get their own map
• Move the bounded transient-read retry (3 attempts, 25-100ms backoff, connection errors only, still fails closed) from the tool-only wrapper into the shared loader. The block-level gate that actually loads first had no retry, so one dropped query failed the whole run
• Block errors no longer surface a raw database query error (SQL + bound params); the message is replaced like the tool path already does, and only the redacted cause is logged
• Redact bound params in the execution failure cause log
• Behavior note: a permission group edit made mid-run now applies from the next run instead of the next block, which matches the original memo design

Type of Change

• Bug fix

Testing

• New tests: cache survives per-block copies, concurrent loads coalesce, per-workspace keys, failed loads evicted, transient retry, no retry on SQL errors, fail-closed on exhaustion, cancellation, no memo on unseeded contexts, root context seeds the cache, block error hides SQL/params
• Verified the new tests fail against the old code
• Affected vitest suites, type-check, lint, check:audits all pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)