Safety fixes: parent-done guard, verification nullsafe, metadata inheritance, role leak

[krandder]

Summary

Defensive improvements that prevent real bugs hit in production. Independent of the review/context/journal endpoints PR.

• Parent-done guard: New verifyCompletion() function blocks marking a parent task done while children are still active (Layer 1: non-terminal children rejected, Layer 2: completionRule=and requires all children done, Layer 3: metadata.repo requires valid stateRef)
• Role leak fix: Claim handler's role_mismatch error no longer includes the assigned agent's ID or the claimer's ID, preventing agents from learning who to impersonate
• Metadata inheritance: Both decompose handlers (incremental + one-shot) now inherit all parent metadata to children, minus bookkeeping fields (claimedAt, claimedBy, claimSessionId, etc.)
• Lease ts fallback: applyLeaseGranted() uses Date.now() when event.ts is missing, preventing leaseExpiresAt = NaN from external tool events
• Type fixes: Pre-existing compilation errors fixed — added "file" to ArtifactKind, path/sizeBytes to ArtifactEvidence, optional source to TaskCompleted/TaskFailed

Not included

• CLI role_mismatch hint (fix Clarify journal.md as primary reviewer artifact #6 from spec): dist/ is gitignored in this repo. Workspace-only patch.
• task.verification?.requiredMode nullsafe fix (fix Add JSONL persistence backend #2 from spec): requiredMode does not exist in the taskcore repo's type system. N/A.

Verification

• npx tsc --noEmit passes (0 errors, down from 6 pre-existing errors on main)
• All 100 tests pass (npx vitest run)
• No dependency on PR Add dependsOn to task creation API #1 (review/context/journal endpoints)

Test plan

• Verify parent-done guard: attempt to mark a parent with active children as done — should get children_pending error
• Verify role_mismatch messages no longer leak agent identities
• Verify decomposed children inherit parent metadata (e.g., informed, tags)
• Verify npx tsc --noEmit passes
• Verify npx vitest run — 100 tests pass, 0 fail