[msg-ingestion] Switch add_message to WAL-first + remove the synchronous model-hit (durability invariant)

Parent: Epic #13889. The request-path flip + the durability payoff.

Problem / scope

add_message historically persisted in-request (and hit the chat/embedding model synchronously, contending with heavy maintenance). Flip it to WAL-first: append to the durable message WAL + return; the drain daemon does the graph-persist + embed off the request path.

Acceptance Criteria

• add_message appends to the message WAL + returns; no in-request graph-persist or model/embedding hit.
• Durability invariant (the headline AC): an add_message that returns an id survives a process restart — a regression test reproducing the de1d9f0b loss: write a self-DM, restart the MC, assert the message is durably present + listable. This is the AC the whole epic exists for.
• list_messages / inbox semantics unchanged from the caller's view (read-after-write within the same process still works — the WAL or its drain backs the read).
• The synchronous model-hit is provably gone from the add_message request path (the original maintenance-interference removed).

Contract Ledger

• Edits: MailboxService.addMessage (the persist path → WAL append).
• Reuses: the message WAL + drain daemon (sibling sub).

Sequencing

Blocked-by the WAL + drain daemon sub (the pipe must drain before add_message writes to it, else messages strand un-drained).