refactor: split pipeline_state.rs into 4 sub-modules with co-located tests

The 1411-line pipeline_state.rs is split into:

- mod.rs: types, transition(), execution_transition(), labels + transition tests (885 lines)
- events.rs: TransitionFired, EventBus, TransitionSubscriber + event-bus tests (114 lines)
- projection.rs: ProjectionError, TryFrom<&PipelineItemView>, read_typed + projection tests (379 lines)
- subscribers.rs: 5 concrete TransitionSubscriber stubs (95 lines)

Tests stay co-located.

No behaviour change. All 42 pipeline_state tests pass; full suite green.

server/src/pipeline_state/events.rs

@@ -0,0 +1,111 @@
+//! Event bus for pipeline state transitions.
+
+use chrono::{DateTime, Utc};
+
+use super::{BranchName, PipelineEvent, Stage, StoryId};
+
+/// Fired when a pipeline stage transition completes.
+#[derive(Debug, Clone)]
+pub struct TransitionFired {
+    pub story_id: StoryId,
+    pub before: Stage,
+    pub after: Stage,
+    pub event: PipelineEvent,
+    pub at: DateTime<Utc>,
+}
+
+/// Trait for side-effect handlers that react to pipeline transitions.
+pub trait TransitionSubscriber: Send + Sync {
+    fn name(&self) -> &'static str;
+    fn on_transition(&self, fired: &TransitionFired);
+}
+
+pub struct EventBus {
+    subscribers: Vec<Box<dyn TransitionSubscriber>>,
+}
+
+impl EventBus {
+    pub fn new() -> Self {
+        Self {
+            subscribers: Vec::new(),
+        }
+    }
+
+    pub fn subscribe<S: TransitionSubscriber + 'static>(&mut self, subscriber: S) {
+        self.subscribers.push(Box::new(subscriber));
+    }
+
+    pub fn fire(&self, event: TransitionFired) {
+        for sub in &self.subscribers {
+            sub.on_transition(&event);
+        }
+    }
+}
+
+impl Default for EventBus {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::{Arc, Mutex};
+    use std::num::NonZeroU32;
+
+    fn nz(n: u32) -> NonZeroU32 { NonZeroU32::new(n).unwrap() }
+    fn fb(name: &str) -> BranchName { BranchName(name.to_string()) }
+    fn sid(s: &str) -> StoryId { StoryId(s.to_string()) }
+
+    #[test]
+    fn event_bus_fires_to_all_subscribers() {
+        use std::sync::Arc;
+        use std::sync::atomic::{AtomicU32, Ordering};
+
+        struct CountingSub(Arc<AtomicU32>);
+        impl TransitionSubscriber for CountingSub {
+            fn name(&self) -> &'static str {
+                "counter"
+            }
+            fn on_transition(&self, _: &TransitionFired) {
+                self.0.fetch_add(1, Ordering::SeqCst);
+            }
+        }
+
+        let counter = Arc::new(AtomicU32::new(0));
+        let mut bus = EventBus::new();
+        bus.subscribe(CountingSub(counter.clone()));
+        bus.subscribe(CountingSub(counter.clone()));
+
+        bus.fire(TransitionFired {
+            story_id: StoryId("test".into()),
+            before: Stage::Backlog,
+            after: Stage::Coding,
+            event: PipelineEvent::DepsMet,
+            at: Utc::now(),
+        });
+
+        assert_eq!(counter.load(Ordering::SeqCst), 2);
+    }
+
+    // ── Bug 502 regression: agent field is not part of Stage ────────────
+
+    #[test]
+    fn bug_502_agent_not_in_stage() {
+        // Bug 502 was caused by a coder agent being assigned to a story in
+        // Merge stage. In the typed system, Stage has no `agent` field at all.
+        // Agent assignment is per-node ExecutionState. This test documents that
+        // the old failure mode is structurally impossible.
+        let merge = Stage::Merge {
+            feature_branch: BranchName("feature/story-1".into()),
+            commits_ahead: NonZeroU32::new(3).unwrap(),
+        };
+        // Stage::Merge has exactly two fields: feature_branch and commits_ahead.
+        // There is no way to attach an agent name to it. The type system
+        // prevents bug 502 by construction.
+        assert!(matches!(merge, Stage::Merge { .. }));
+    }
+
+    // ── TransitionError Display ─────────────────────────────────────────
+}