step 5 (partial): strip dropped packages from production code

Removed all references to dropped packages in non-test code.
Zero dropped imports, store refs, or model types remaining.

Major removals:
  - scheduler/ package (entire dir) — tasks moved to extension track
  - taskutil/ package (entire dir)
  - health/ package (entire dir) — provider/tool health
  - sandbox/provider_module.go — provider.complete module
  - handlers: workflow_entry, workflow_instances, workflow_forms,
    workflow_assignments, workflow_monitor, health_admin (6 files)
  - auth/session.go, middleware/session_auth.go
  - store/{postgres,sqlite}/sessions.go, tasks.go

Rewrites:
  - store/{postgres,sqlite}/health.go — kernel-only Prune
    (ws_tickets, rate_limit_counters, stale presence)
  - handlers/admin.go: 847→467 lines (stripped provider CRUD)
  - handlers/teams.go: 520→411 lines (stripped model listing)
  - sandbox/runner.go: removed ProviderResolver
  - sandbox/workflow_module.go: 216→83 lines (definition-only)
  - main.go: 1579→1325 lines (stripped dropped package init)
  - pages/pages.go: stripped channel/session lookups
  - events/types.go: stripped chat/channel/workspace event routes
  - models: stripped stale types, constants, notification types

Store interface cleanup:
  - Removed SessionStore, TaskStore from Stores struct
  - Stripped workflow assignment methods from WorkflowStore iface
  - Stripped assignment methods from PG+SQLite workflow stores
  - Updated testhelper.go table list to kernel-only

Migrations: removed 008_tasks.sql (both dialects)

-9665/+69 lines across 51 files.

server/sandbox/runner.go

@@ -44,8 +44,7 @@ type RunContext struct {
 	// UserID is the acting user for provider resolution (BYOK chain).
 	UserID string
 
-	// ChannelID is the channel context, if any. Used for provider
-	// resolution when a channel has a pinned provider config.
+	// ChannelID is the context identifier, if any.
 	ChannelID string
 }
 
@@ -55,7 +54,6 @@ type Runner struct {
 	stores          store.Stores
 	packagesDir     string             // v0.38.0: disk path for load() support
 	notifier        NotificationSender // nil = notifications module unavailable
-	resolver        ProviderResolver     // nil = provider module unavailable
 	connResolver    ConnectionResolver  // nil = connections module unavailable (v0.38.1)
 	db              *sql.DB              // nil = db module unavailable
 	dbPostgres      bool                 // true = use $N placeholders; false = use ?
@@ -75,11 +73,6 @@ func (r *Runner) SetNotifier(n NotificationSender) {
 	r.notifier = n
 }
 
-// SetProviderResolver attaches the provider resolver for the provider.complete module.
-func (r *Runner) SetProviderResolver(pr ProviderResolver) {
-	r.resolver = pr
-}
-
 // SetConnectionResolver attaches the connection resolver for the connections module (v0.38.1).
 func (r *Runner) SetConnectionResolver(cr ConnectionResolver) {
 	r.connResolver = cr
@@ -315,11 +308,6 @@ func (r *Runner) buildModulesWithLibCtx(ctx context.Context, packageID string, m
 			httpCfg.AllowPrivateIPs = r.allowPrivateIPs
 			modules["http"] = BuildHTTPModule(ctx, httpCfg)
 
-		case models.ExtPermProviderComplete:
-			if r.resolver != nil && rc != nil && rc.UserID != "" {
-				provCfg, ok := ParseRequiresProvider(manifest)
-				if ok {
-					modules["provider"] = BuildProviderModule(ctx, r.resolver, rc.UserID, provCfg)
 				}
 			}