feat(orchestrator): tasks tab with register, inbox and queue

Add a Tasks tab that lists the kvb-org-rasci register next to the inbox
and the heavy-job queue, in list, board and RASCI matrix views, each
task with its roles, WSJF, open work and the merge flow of its worktree.

- Task priority pins and WSJF estimates are signed with the operator's
  passkey and applied by the runner through rasci.py; the hub verifies
  the signature itself before it queues a job or logs the change, the
  runner verifies it again and runs only the checked argv, from /, with
  a pinned PATH and a 30 s process-group limit.
- The runner refuses task changes into a council that is a symlink, not
  owned by its uid or given by a relative path, and while the installed
  council.py, nofollow.py or rasci.py differ from the tree.
- Only tasks the hub can sign whole are editable (task slug and length).
- Page lookups keyed by register text use Object.hasOwn, so a status or
  party named like an Object.prototype member cannot break the views.
- The inbox screen renders through the tasks screen, so its task filter
  shows with "Wartet auf Operator" pressed.

Tests: 604 unit tests OK, e2e 15/15 OK (Chromium and Firefox).

🎯 Fix: 93 %
💥 Break: 5 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/orchestrator.sh

@@ -4,8 +4,9 @@
 #            write its .env, build and start the container, register the MCP
 #            server for Claude Code, build pkgmgr from the newest signed tag of
 #            PKGMGR_REPO and enable the tree timer and the cleanup path unit,
-#            enable the offices path unit; re-enable the runner and re-register the hook when the migration
-#            took them over
+#            enable the offices path unit; re-enable the runner and re-register
+#            the hook when the migration took them over; an enabled runner gets
+#            the fresh unit and a restart
 #   migrate  move every trace of the earlier name to the kvb-orchestrator names
 #            once: container, image, code, state, approvals, pinned keys, MCP
 #            server, PermissionRequest hook, runner unit; a second run changes
@@ -13,7 +14,9 @@
 #   check    image imports, container, logs, HTTP, pinned keys, hook, runner,
 #            disk; exit 1 when a check fails
 #   pin      pin the credential blob the "Passkey registrieren" settings show
-#   runner   install, enable and restart the runner user service
+#   runner   install, enable and restart the runner user service; disable it
+#            and exit 1 while the installed council.py, nofollow.py or
+#            rasci.py differ from this tree
 #   hook     register the PermissionRequest hook in ~/.claude/settings.json,
 #            replacing an earlier entry, keeping everything else and the file
 #            mode, after a copy to settings.json.before-kvb-orchestrator-hook
@@ -254,17 +257,26 @@ install_all() {
 	install_hub
 	tree_timer
 	offices_unit
-	if ((TOOK_RUNNER)); then runner || true; fi
+	if ((TOOK_RUNNER)) || runner_enabled; then runner || true; fi
 	if ((TOOK_HOOK)); then
 		if [[ -f "${HUB}/client/permission_hook.py" ]]; then hook; else warn "skills: run 'make orchestrator-hook' once the Agent Orchestrator is installed"; fi
 	fi
 }
 
+runner_enabled() {
+	has_systemd && [[ "$(systemctl --user is-enabled "${RUNNER}" 2>/dev/null || true)" == "enabled" ]]
+}
+
 runner() {
 	if ! has_systemd; then
 		warn "skills: no systemd user session; the runner is off and approved operator commands wait."
 		return 1
 	fi
+	if ! skills_current; then
+		systemctl --user disable --now "${RUNNER}" >/dev/null 2>&1 || true
+		warn "skills: ${INSTALLED_SKILLS} holds other council.py, nofollow.py or rasci.py than this tree; run 'make install' to enable ${RUNNER}."
+		return 1
+	fi
 	cp -f "${HUB}/systemd/${RUNNER}" "${UNITS}/"
 	systemctl --user daemon-reload
 	systemctl --user enable "${RUNNER}"