feat: Introduce new Runbook execution engine

[BinaryMuse]

Overview

This PR implements a persistent document context system that fundamentally changes how runbook execution state is managed. Instead of maintaining global state across executions, each block now derives its context from the blocks above it in the document, creating a clear "chain of causality" for execution.

Motivation

Previously, execution context was scoped to a single execution flow (#135), requiring global state management across runs. This made issues like #82 difficult to resolve and created ambiguity about which blocks set contextual data.

The new architecture:

• Replaces execution-scoped context with document-level context
• Enables context recovery across tab closes and app restarts (e.g., preserving mktemp -d output)
• Creates foundation for future features like multiple execution "runs" per runbook
• Enables potential realtime shared execution by serializing context to collaborators

Architecture

Core Runtime System (backend/src/runtime)

Document & DocumentActor

• Document contains a vector of Block objects with associated BlockContexts
• DocumentActor manages document lifecycle and handles commands via message passing
• Accessed through DocumentHandle which sends DocumentCommands
• Updates reactively when BlockNote document changes from frontend

Block Execution Model

Replaced the BlockHandler pattern with BlockBehavior trait:

• async fn passive_context(&self, &ContextResolver, Option<&BlockLocalValueProvider>) -> Result<Option<BlockContext>> — Defines passively set context (cwd, env vars, ssh host, template variables). Uses BlockLocalValueProvider for local-only storage access.
• async fn execute(self, ExecutionContext) -> Result<Option<ExecutionHandle>> — Executes block using ExecutionContext, consuming self. Returns optional ExecutionHandle for long-running operations.

BlockContext

• Type map pattern storing context structs (DocumentCwd, DocumentEnvVar, SshHost, etc.)
• Each block's context = union of all BlockContexts from blocks above it
• Maintains causality: changes below a block don't affect blocks above
• Enables predictable, deterministic context resolution
• Each block has a passive context (set when the document updates) and an active context (set when the block executes). The active context is cleared each time the block beings execution.

ContextResolver

• Lightweight context reduction for resolving template strings within passive_context()
• Prevents circular dependencies during context building
• Provides clean API for template interpolation

┌────────────────────────────────────────────────────┐
│                      Document                      │            ┌─────────────────┐
│                  (DocumentActor)                   │            │ Block Execution │
│                                                    │            └─────────────────┘
│   ┌──────────────────┐      ┌──────────────────┐   │                     │
│   │      Block       │─────▶│   BlockContext   │   │                     │
│   │  (BlockBehavior) │      │                  │   │                     │
│   └──────────────────┘      └──────────────────┘   │                     │
│                                       ▲            │                     ▼
│   ┌──────────────────┐      ┌──────────────────┐   │       ┌──────────────────────────┐
│   │      Block       │─────▶│   BlockContext   │◀──┼───────│     ExecutionContext     │
│   │  (BlockBehavior) │      │                  │   │       │                          │
│   └──────────────────┘      └──────────────────┘   │       └──────────────────────────┘
│                                       ▲            │
│   ┌──────────────────┐      ┌──────────────────┐   │
│   │      Block       │─────▶│   BlockContext   │   │
│   │  (BlockBehavior) │      │                  │   │
│   └──────────────────┘      └──────────────────┘   │
└────────────────────────────────────────────────────┘

Frontend Integration

ClientMessageChannel

• Message channel for runtime -> frontend communication
• Sends ResolvedContext updates to frontend per block as document changes
• Enables reactive UI updates without polling
• Foundation for realtime collaborative execution

BlockLocalValueProvider

• Abstraction for blocks that need local-only storage (credentials, local paths)
• Key-value storage scoped per block and runbook
• Used by local-var and local-directory blocks
• Keeps sensitive data out of shared document props

Frontend Pattern

• Blocks use useBlockContext(blockId) hook to receive resolved context
• useBlockKvValue() for local-only data via BlockLocalValueProvider
• Blocks simplified to prop management; runtime handles all context resolution
• No direct backend state manipulation from UI components

---

TODO:

• Add workspace namespace to string templating
• Add document/block data to string templating
• Log executions in exec_log

[BinaryMuse]

@ellie Reqwest offers several features for TLS handling, which should we set it to in order to match the behavior of the other TLS stuff?

https://docs.rs/reqwest/latest/reqwest/index.html#optional-features

[ellie]

native-tls is the one!

Can elaborate later but it was really difficult to get enterprise cert chains working properly with rustls