feat(orchestrator): tasks tab with register, inbox and queue

Add a Tasks tab that lists the kvb-org-rasci register next to the inbox
and the heavy-job queue, in list, board and RASCI matrix views, each
task with its roles, WSJF, open work and the merge flow of its worktree.

- Task priority pins and WSJF estimates are signed with the operator's
  passkey and applied by the runner through rasci.py; the hub verifies
  the signature itself before it queues a job or logs the change, the
  runner verifies it again and runs only the checked argv, from /, with
  a pinned PATH and a 30 s process-group limit.
- The runner refuses task changes into a council that is a symlink, not
  owned by its uid or given by a relative path, and while the installed
  council.py, nofollow.py or rasci.py differ from the tree.
- Only tasks the hub can sign whole are editable (task slug and length).
- Page lookups keyed by register text use Object.hasOwn, so a status or
  party named like an Object.prototype member cannot break the views.
- The inbox screen renders through the tasks screen, so its task filter
  shows with "Wartet auf Operator" pressed.

Tests: 604 unit tests OK, e2e 15/15 OK (Chromium and Firefox).

🎯 Fix: 93 %
💥 Break: 5 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/branch-tree.json

@@ -42,7 +42,18 @@
             "local-branch"
           ],
           "reason": "dirty: 1 paths",
-          "result": null
+          "result": null,
+          "flow": {
+            "pull": [
+              "origin/main",
+              "store-i18n"
+            ],
+            "push": [
+              "main",
+              "production"
+            ],
+            "source": "file"
+          }
         },
         {
           "branch": "feature/done",
@@ -77,7 +88,8 @@
             "remote-branch"
           ],
           "reason": "merged into main by #12",
-          "result": null
+          "result": null,
+          "flow": null
         },
         {
           "branch": "feature/kept",
@@ -135,7 +147,8 @@
           "skip": null,
           "actions": [],
           "reason": "default or protected branch",
-          "result": null
+          "result": null,
+          "flow": null
         },
         {
           "branch": null,
@@ -164,7 +177,12 @@
             "worktree"
           ],
           "reason": "unmerged: 1 commits not in origin/main",
-          "result": null
+          "result": null,
+          "flow": {
+            "pull": [],
+            "push": [],
+            "source": "invalid"
+          }
         }
       ]
     },