feat(lessons): machine lessons-journal — additive table + observer leaf (ORCH-098)

Step 1 ("Foundation", F2) of the self-improvement epic: formalise free-text
"lessons" from memory/ into a machine-readable `lessons` table — the foundation
for the future retrospective agent (E2), the RICE prioritiser (E3) and Стрим.

- src/lessons.py: pure never-raise observer leaf (record/get/update/snapshot),
  kill-switch only, NO repo scope (observer-only; records about any repo incl.
  enduro; repo cut on the read side). Slug-convention constants.
- src/db.py: additive idempotent `lessons` table in init_db() (+3 indexes);
  nullable attribution columns from the start (NFR-6, _ensure_column forward-safe);
  helpers record_lesson/get_lessons/update_lesson/lessons_snapshot/
  lessons_recent_dup_exists (auto-dedup window).
- 4 auto-detectors (best-effort, source="auto", deduped): gate_failure
  (_handle_qg_failure_rollbacks), merge_hold (_handle_merge_verify HOLD),
  transient_retry (launcher._finalize_transient budget-exhaustion), deploy_degraded
  (post-deploy DEGRADED -> set_repo_freeze).
- src/main.py: GET /lessons, POST /lessons, POST /lessons/{id} + read-only
  `lessons` block in GET /queue; off-switch -> {"enabled": false}.
- src/config.py: lessons_enabled / lessons_query_limit_default / lessons_dedup_window_s.
- tests/test_lessons.py: TC-01..TC-12 (unit + integration), all green.
- Docs: CLAUDE.md, docs/architecture/README.md (component + schema + API), CHANGELOG.

Invariant: the journal is an OBSERVER, not a Quality Gate — STAGE_TRANSITIONS /
QG_CHECKS / check_* / machine-verdict / existing table schemas are byte-for-byte
untouched; enduro not affected. never-raise on every public fn + injection.

Refs: ORCH-098
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.py

@@ -291,6 +291,27 @@ class Settings(BaseSettings):
     coverage_tool_fail_closed: bool = False
     coverage_run_timeout_s: int = 900
 
+    # ORCH-098 (FND/F2): machine lessons-journal — additive `lessons` table + leaf
+    # src/lessons.py (never-raise observer, by образцу serial_gate/coverage_gate/
+    # metrics). The journal is an OBSERVER, never a Quality Gate: writing a lesson
+    # never influences any repo's pipeline, so — UNLIKE the gate leaves — it has NO
+    # `*_repos` scope (it records lessons about ANY repo, incl. enduro-trails; the
+    # repo cut lives on the READ side, get(repo=...)). The only regulator is a single
+    # global kill-switch (ADR-001 D2). See ADR-001-lessons-journal.md / adr-0033.
+    #   lessons_enabled            -> SINGLE kill-switch (env ORCH_LESSONS_ENABLED).
+    #                                 False -> record/get/update/snapshot inert (no DB
+    #                                 access), endpoints return {"enabled": false},
+    #                                 auto-record injections no-op. Default True.
+    #   lessons_query_limit_default-> default LIMIT for GET /lessons / get() when the
+    #                                 caller passes none.
+    #   lessons_dedup_window_s     -> auto-record dedup window (s): a second auto lesson
+    #                                 with the same (work_item_id, lesson_type, stage)
+    #                                 inside this window is suppressed (D4). manual
+    #                                 records are never deduped. Default 3600 (1h).
+    lessons_enabled: bool = True
+    lessons_query_limit_default: int = 100
+    lessons_dedup_window_s: int = 3600
+
     # ORCH-057: legacy root-owned file ownership detect + actionable worktree error
     # (follow-up ORCH-040). Three additive, kill-switch-reversible layers: (1) an
     # actionable RuntimeError in git_worktree.ensure_worktree when a worktree fails