fix: address Phase 4 code review findings

[prosdev]

Summary

Fixes all findings from the 3-agent parallel code review (security, logic, quality) run against Phase 4.

• Ownership leak on delete (security + logic WARNING) — Added ownership check on RunManager path in delete_run. Previously, any authenticated user could confirm another user's run was active (409 vs 404).
• Admin bypass inconsistency (logic MEDIUM) — Stream and status DB fallback paths now use owner_filter(auth) instead of auth.owner_id, matching cancel/delete/list behavior.
• Duplicated _owner_filter (quality WARNING) — Consolidated into shared owner_filter() in auth/deps.py. Both route modules now import from one place.
• Duplicated _run_list_item (quality WARNING) — Consolidated into run_to_list_item() in schemas/runs.py.
• Non-deterministic test (quality WARNING) — test_delete_active_run_rejected now uses DB-inserted run instead of racing against fast execution.
• Merged validate exception blocks (quality SUGGESTION) — Two identical except GraphBuildError blocks collapsed into one try.
• Missing test coverage (quality SUGGESTION) — Added test_delete_live_run_in_manager_rejected verifying different owner gets 404 (not 409) on RunManager path.
• CLAUDE.md rule — Added "Code review before PR" to non-negotiables.

Code review results

All 3 reviewers ran on this fix branch before PR:

Agent	Verdict	Notes
security-reviewer	APPROVE	Original leak confirmed fixed, no new issues
logic-reviewer	APPROVE	1 pre-existing timing edge case (not a regression)
quality-reviewer	REQUEST CHANGES	_owner_filter duplication, missing RunManager delete test

Second round addressed quality findings — owner_filter consolidated, RunManager delete test added.

Test plan

• 241 unit tests passing (1 new: test_delete_live_run_in_manager_rejected)
• Lint clean (ruff check)
• Typecheck clean (tsc --noEmit)

🤖 Generated with Claude Code