openclaw - 💡(How to fix) Fix pr-release: persist workflow state, repo locks, idempotency, and audit events

What to build

Implement SQLite-backed workflow state as the source of truth for PR/release workflows, including repo-level locks, idempotency keys for Lark card actions, and sanitized audit events.

Acceptance criteria

• Migrations create workflows, workflow_repos, workflow_events, processed_actions, and repo_locks with the fields from the spec.
• Mutating actions acquire a workflow lock, check status guards, check idempotency, run once, update state, and release the lock.
• Repo locks prevent active workflows from selecting the same repo concurrently and release on completed, cancelled, or failed_terminal.
• Stale workflows keep repo locks and surface a human action path.
• Audit logging stores structured event JSON and sanitized command output.
• Unit/integration tests cover duplicate action suppression, repo lock conflicts, lock release, and stale behavior.

Blocked by

• pr-release: add config, operator authorization, and command skeleton