feat(orchestrator): W1 operator tasks, diff previews and bound commit asks

Operator tasks move from the Inbox into Tasks with the Waits on Operator filter. Review and commit asks carry the staged diff; a file whose old or new blob holds an armour line or a detection-pattern match, or every file when no pattern loads, ships only its path, status, mode and counts. The approval binds to the staged tree id from git write-tree, the encoded request body respects the hub limit, and the hub image ships every client module signed.py loads. Committed below the bar on the operator's word 2026-11-12 (no further per-bundle tests, one gate after the merge): the full hub suite and the W1 e2e never ran, two high MEDUSA rows (sandbox_paths.py FLOOR, permission_hook.py ask POST) wait for their acceptance.

🎯 Fix: 85 %
💥 Break: 12 %
💸 Cost: 30 %
⏱️ Time: 30 %
🛡️ Security: 50 %
🏆 Score: 100
🚦 Gate: ⛔ fix 85 % < 90, break 12 % > 5; security 50 % < 100: ask the operator before the commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_surface.py

@@ -24,16 +24,16 @@ class TestHubSurface(HubCase):
                 self.assertNotIn(gone, html)
         self.assertIn('<nav class="tabs" id="tabs"', html)
 
-    def test_badges_count_waiting_items_active_agents_and_open_runner_jobs(self):
+    def test_badges_count_waiting_operator_tasks_on_tasks_active_agents_and_open_runner_jobs(self):
         now = 1000.0
         inbox = [{"until": None}, {"until": None}, {"until": now + 60}]
         claims = [{"agent": "A", "beat": now - 10}, {"agent": "A", "beat": now - 20}, {"agent": "B", "beat": now - 900}, {"agent": "C", "beat": now - 901}, {"agent": "D", "beat": None}]
         jobs = [{"status": "queued"}, {"status": "running"}, {"status": "done"}, {"status": "failed"}]
-        self.assertEqual(view.badges(inbox, claims, jobs, now), {"inbox": 2, "agents": 2, "artifacts": 2})
-        self.assertEqual(view.badges([], [], [], now), {"inbox": 0, "agents": 0, "artifacts": 0})
+        self.assertEqual(view.badges(inbox, claims, jobs, now), {"tasks": 2, "agents": 2, "artifacts": 2})
+        self.assertEqual(view.badges([], [], [], now), {"tasks": 0, "agents": 0, "artifacts": 0})
         self.claim("s1", "Skills session")
         self.create_ask(ASK)
-        self.assertEqual(self.snapshot()["badges"], {"inbox": 1, "agents": 1, "artifacts": 0})
+        self.assertEqual(self.snapshot()["badges"], {"tasks": 1, "agents": 1, "artifacts": 0})
         self.assertIn("<title>(1) Agent Orchestrator</title>", self.index())
 
     def test_register_workers_map_to_the_agent_named_before_the_bracket(self):