feat(tests): pytest-asyncio test suite — 119 tests across 3 modules

Infrastructure (T01):
- tests/conftest.py: sync schema setup (psycopg2), per-test table
  truncation, async ASGI client with get_session override
- pyproject.toml: [tool.pytest.ini_options] asyncio_mode=auto
- Makefile: make test target with TEST_DATABASE_URL

Core router tests (T02): 19 tests
- domains, topics, workstreams, tasks, decisions + state summary
- Caught real bug: topic router missing duplicate-slug 409 guard (fixed)

TD/EP/Contributions/SBOM tests (T03): 10 tests
- CRUD + status transitions + lifecycle guard + SBOM ingest

MCP smoke tests (T04): 12 tests
- get_state_summary, create_task, update_task_status,
  add_progress_event, flag_for_human HTTP shapes

CI gate (T05): make test documented in CLAUDE.md session protocol

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -95,7 +95,13 @@ Every Claude Code session in this repository must follow this ritual:
 1. Call `add_progress_event()` to log what was done, decided, or discovered
 2. If new tasks were identified, create them with `create_task()`
 3. If decisions were made, record them with `record_decision()`
-4. If any workplan files were written or modified this session, run:
+4. If API routers or models were changed, run the test suite as a gate:
+   ```bash
+   cd state-hub && make test
+   ```
+   Requires postgres running (`make db`) and `custodian_test` database to exist.
+   Create it once with: `psql -U custodian -c "CREATE DATABASE custodian_test"`
+5. If any workplan files were written or modified this session, run:
    ```bash
    cd state-hub && make fix-consistency REPO=the-custodian
    ```