feat(realism): EditAction read-modify-write of planted files

Stage 3b of the realism migration. A TODO.md planted on Monday gets a
checkbox flipped on Tuesday; a notes file grows a follow-up line; a
cron log gets a fresh entry tacked on. The synthetic_files row's
edit_count, last_modified, and content_hash advance.

New surface:

- EditAction dataclass (peer of FileAction in scheduler.py): carries
  decky, path, persona, content_class, previous_body, mtime, and
  synthetic_file_uuid for the worker's update path.
- realism.bodies.next_iteration(cls, persona, prev, rng): per-class
  deterministic mutators. TODO flips an unchecked box and/or appends;
  notes/drafts/scripts append; logs are append-only (mirroring real
  log behaviour). Canary, cache_tmp, email raise KeyError —
  unsupported.
- realism.planner.pick gains an edit branch: 60% create, 30% edit
  (when an edit_candidate is supplied), 10% leave-alone. Returns
  None on leave-alone — quiet ticks are realism too.
- scheduler.pick_file pre-fetches a single edit candidate via
  repo.pick_random_synthetic_file_for_edit ~50% of ticks; the
  planner decides whether to use it.
- SSHDriver._run_edit: turns next_iteration output into a
  plant_file call (mtime-bumped, mode 0o644). Stashes new_body in
  result.payload so the worker can hash it for synthetic_files.
- worker._bump_synthetic_file_after_edit: patches edit_count + 1,
  last_modified=now, content_hash, last_body for the row UUID.
  No-op when the row was pruned mid-flight.
- events.to_row / topic_for / event_type_for now recognise
  EditAction (kind="file", action="file:edit").

decnet/orchestrator/worker.py

@@ -212,14 +212,24 @@ async def _one_tick(repo: BaseRepository, bus) -> None:
         await _persist_email(repo, action, result, bus)
     else:
         await _persist_event(repo, action, result, bus)
-        if isinstance(action, scheduler.FileAction) and result.success:
-            try:
-                await _record_synthetic_file(repo, action)
-            except Exception as exc:  # noqa: BLE001
-                logger.warning(
-                    "orchestrator: synthetic_files write failed dst=%s path=%s: %s",
-                    action.dst_uuid, action.path, exc,
-                )
+        if result.success:
+            if isinstance(action, scheduler.FileAction):
+                try:
+                    await _record_synthetic_file(repo, action)
+                except Exception as exc:  # noqa: BLE001
+                    logger.warning(
+                        "orchestrator: synthetic_files write failed dst=%s path=%s: %s",
+                        action.dst_uuid, action.path, exc,
+                    )
+            elif isinstance(action, scheduler.EditAction):
+                try:
+                    await _bump_synthetic_file_after_edit(repo, action, result)
+                except Exception as exc:  # noqa: BLE001
+                    logger.warning(
+                        "orchestrator: synthetic_files edit-bump failed "
+                        "dst=%s path=%s: %s",
+                        action.dst_uuid, action.path, exc,
+                    )
 
 
 async def _persist_event(repo, action, result, bus) -> None:
@@ -284,6 +294,41 @@ async def _persist_email(repo, action: EmailAction, result, bus) -> None:
     )
 
 
+async def _bump_synthetic_file_after_edit(repo, action, result) -> None:
+    """Patch ``synthetic_files`` after a successful EditAction.
+
+    Bumps ``edit_count`` + ``last_modified`` + ``content_hash`` so the
+    dashboard's lineage view shows the change.  When the row's UUID
+    isn't on the action (planner produced an edit plan from a stale
+    candidate that the repo pruned in between), the update is a no-op
+    — resurrecting a pruned row isn't this layer's job.
+
+    The new body comes from ``result.payload["new_body"]`` (the SSH
+    driver stashes it on success); we re-hash here so the orchestrator,
+    not the driver, owns the canonical hash field.
+    """
+    if not action.synthetic_file_uuid:
+        return
+    new_body = result.payload.get("new_body", "")
+    rows = await repo.list_synthetic_files(decky_uuid=action.dst_uuid, limit=200)
+    existing = next(
+        (r for r in rows if r.get("uuid") == action.synthetic_file_uuid),
+        None,
+    )
+    if existing is None:
+        return  # candidate was pruned mid-flight; skip silently
+    patch: dict = {
+        "last_modified": datetime.now(timezone.utc),
+        "edit_count": int(existing.get("edit_count", 0)) + 1,
+    }
+    if new_body:
+        patch["content_hash"] = hashlib.sha256(
+            new_body.encode("utf-8"),
+        ).hexdigest()
+        patch["last_body"] = new_body[:65536]
+    await repo.update_synthetic_file(action.synthetic_file_uuid, patch)
+
+
 async def _record_synthetic_file(repo, action) -> None:
     """Persist (or patch) a synthetic_files row after a FileAction plant.