feat(orchestrator): tasks tab with register, inbox and queue

Add a Tasks tab that lists the kvb-org-rasci register next to the inbox
and the heavy-job queue, in list, board and RASCI matrix views, each
task with its roles, WSJF, open work and the merge flow of its worktree.

- Task priority pins and WSJF estimates are signed with the operator's
  passkey and applied by the runner through rasci.py; the hub verifies
  the signature itself before it queues a job or logs the change, the
  runner verifies it again and runs only the checked argv, from /, with
  a pinned PATH and a 30 s process-group limit.
- The runner refuses task changes into a council that is a symlink, not
  owned by its uid or given by a relative path, and while the installed
  council.py, nofollow.py or rasci.py differ from the tree.
- Only tasks the hub can sign whole are editable (task slug and length).
- Page lookups keyed by register text use Object.hasOwn, so a status or
  party named like an Object.prototype member cannot break the views.
- The inbox screen renders through the tasks screen, so its task filter
  shows with "Wartet auf Operator" pressed.

Tests: 604 unit tests OK, e2e 15/15 OK (Chromium and Firefox).

🎯 Fix: 93 %
💥 Break: 5 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_executors.py

@@ -17,7 +17,6 @@ from hub_support import (
     GIT_ENV,
     PAGE,
     PRESENT,
-    RUNNER,
     TREE,
     runner,
     signing,
@@ -33,17 +32,6 @@ class TestHubExecutors(HubCase):
     def trust(self, name: str) -> verifier.Trust:
         return verifier.Trust(approvers=self.approvers, replay=self.replay / f"{name}.json", origin=self.origin)
 
-    def runner_jobs(self) -> list[dict]:
-        status, _, body = self.call("GET", "/api/runner/jobs", None, self.client())
-        self.assertEqual(status, 200, body)
-        return json.loads(body)["jobs"]
-
-    def run_runner(self) -> None:
-        trust = ["--approvers", str(self.approvers), "--replay", str(self.replay / "runner.json")]
-        command = [sys.executable, str(RUNNER), "--port", str(self.port), "--interval", "0.1", *trust, "--once"]
-        done = subprocess.run(command, capture_output=True, text=True, timeout=60, check=False)
-        self.assertEqual(done.returncode, 0, done.stderr)
-
     def test_the_runner_runs_only_signed_commands_once(self):
         command = "echo hello && echo world >&2"
         register = {