Combine project context and audit with account main

Why: X3 must share one Backend surface with the X1 context and X2 audit candidates while current main now owns account migrations 32-34.

Evidence: go test -p 1 ./... and go build ./... passed on the merged tree; isolated PostgreSQL project audit, migration, and work-context tests passed against a temporary instance. Default parallel go test ./... had only the unrelated sandbox orphan timing test fail; its isolated ten-run replay passed.

Impact: Preserve account migrations 32-34, place X1/X2 migrations at 35-43, and retain account-effective write guards alongside project audit/context behavior. X3 observer remains a contract only.

Refs: TT-C01-TT-C04, TT-A01-TT-A04, TT-N03, TT-R01; combination probe d9b00c2

internal/cmdbus/cmdbus.go

@@ -5,6 +5,7 @@ package cmdbus
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
@@ -96,6 +97,7 @@ type Request struct {
 	Actor           string
 	Owner           string
 	ConversationID  string
+	OperationID     string // overwritten by the trusted bus before handler execution
 	AnchorMessageID string // 确认卡锚定的发起消息（内联渲染）
 	Confirmed       bool   // 危险命令经确认卡放行后的执行
 	HostProjectID   string // EXT-18：分发所属基座项目（空＝无项目上下文）
@@ -369,12 +371,19 @@ func (b *Bus) Dispatch(ctx context.Context, req Request) Response {
 	if err := b.checkEffectiveAccount(ctx, accountActor(req)); err != nil {
 		return b.accountRejected(req.ID, start)
 	}
+	// The domain handler can persist this trusted ID with its transaction/outbox.
+	// Entropy, not the clock or caller Params, distinguishes concurrent operations.
+	// A handler failure still writes only a rejected audit receipt without an ID.
+	var opBytes [24]byte
+	if _, err := rand.Read(opBytes[:]); err != nil {
+		return receipt(agentcommand.StateUnknown, "", "operation ID unavailable")
+	}
+	req.OperationID = "op_" + hex.EncodeToString(opBytes[:])
 	payload, err := h(ctx, req)
 	if err != nil {
 		return receipt(agentcommand.StateRejected, "", "rejected: "+err.Error())
 	}
-	op := fmt.Sprintf("op_%s_%d", strings.ReplaceAll(strings.TrimPrefix(req.ID, ""), ".", "_"), b.now().UnixNano())
-	return Response{Receipt: b.auditReceipt(req, agentcommand.StateCommitted, op, "", start), Payload: payload}
+	return Response{Receipt: b.auditReceipt(req, agentcommand.StateCommitted, req.OperationID, "", start), Payload: payload}
 }
 
 // Confirm 确认卡回道：actionID=confirm 执行挂起请求（entrance 归一 card），其余视为取消。