feat(board): SEA-1728 part 4a — durable issue projection + live issue=16 fan-out

[seal-agent]

Part 4a of the SEA-1728 board projection: the durable issue projection and its live issue=16 fan-out. Matt ruled the connect-time snapshot is delivered the comms way (boundary frame + ListBoardIssues read RPC) — that is part 4b, gated on the compass-repo proto PR (#172). This PR is the buildable-now core: the live upsert fan-out, the PG-rehydrated durable cache, and the Snapshot()/Rehydrate() surface 4b reads.

What lands

go/internal/board/issue_projection.go — IssueProjection, sibling to the session Projection:

• PublishIssueUpdate(ctx, *Issue) — the part-3 ingestion sink. Maps proto → store.IssueForgeFields, UpsertIssueForgeFields (durable commit → stable id), GetIssue reads back the full committed row, maps back, records in the cache + Publishes the SubscribeEventsResponse_Issue (issue=16) variant. The DB round-trip runs outside the projection mutex (mirrors PublishSessionStatus lock discipline); only the map-record + non-blocking Publish are under the lock. The read-back is load-bearing: it makes a prior human-set lifecycle state visible on the wire, so a forge re-poll fans committed truth, not a clobbered state (the 3a no-clobber property, now observable).
• Snapshot() — every issue, all states incl. ARCHIVED (the Done view needs archived), sorted by id, each a deep clone the caller owns. The surface 4b's ListBoardIssues handler reads.
• Rehydrate(ctx) — loads the durable board from Postgres into the cache at boot (DL-019: the store is truth, the projection is a read-through cache). Does not publish.
• issueToProto / protoToForgeFields — the sole proto↔store mapping edge (this is the only place importing both store and compassv1; the store package imports no generated code). The forge-only input carries no lifecycle/machinery field, the compile-time guarantee the forge upsert cannot clobber state.

Depends on parts 3a + 3 (both merged)

4a imports store.Issue / UpsertIssueForgeFields / GetIssue / ListIssues from part 3a (#167) and is the projection sink for part 3 ingestion (#168) — both merged to main, so this PR targets main directly. No serve.go wiring here — constructing the projection + Rehydrate at boot + wiring it as the part-3 ingestion sink lands with 4b.

Review

One adversarial review pass (overall_correctness: correct, 0 high, 2 medium, 4 low). All fixed or noted:

• [medium, fixed] cloneIssue was a manual field-by-field copy that silently omitted Tracker/Prs (nil today, a drift hazard on evolution) → replaced with proto.Clone, which tracks the message definition automatically.
• [medium, fixed] the Snapshot clone-independence test only mutated a scalar → extended to mutate Forge.Host + Labels[0] and assert the cache is untouched (the sub-message/slice deep-copy is the load-bearing half).
• [low, fixed] added TestPublishInvalidIssueErrorsWithoutRecordingOrFanning — an empty coordinate returns the wrapped store error and records/fans nothing (trailing-sentinel proves the negative fan-out).
• [low, fixed] documented the single-poller assumption on PublishIssueUpdate (the commit-order-vs-lock-order window is harmless while one poller owns each coordinate).
• [low, noted] every ingestion upsert costs two DB round-trips (UpsertIssueForgeFields then GetIssue); folding to one would change the frozen 3a store API (RETURNING *) — tracked as a store-layer follow-up, out of scope here.

Verification

golangci-lint run --config .golangci.yml ./internal/board/... = 0 issues; go build ./... && go vet; default-lane go test; and go test -tags pgtest -race ./internal/board/... — 6 projection cases (fan-out, committed-state read-back, sorted deep-clone Snapshot, Rehydrate durability, empty board, invalid-issue error path) + every existing board test, green, no race.

Refs SEA-1728.

[linear-code]

SEA-1728