feat(commit-gate): land board transitions with the work (ADR-0008)

[SUaDtL]

What & why

Implements ADR-0008 (accepted) — commit-gate is the single board-sync chokepoint. Resolves the order-of-operations trap behind #142: because open-tasks.md is versioned, a board flip only goes live when its own change merges, so flips drifted into lagging chore(board) PRs or post-commit edits that depended on cross-session memory and silently fell off (#138 never marked v2.release.0002-0006 done; #140 needed the separate #141).

Co-locating the flip with the work commit makes it self-correcting: invisible on main until merge, atomic when the work lands, and abandoned with the PR if the PR is abandoned. No task→commit inference is introduced — the human still declares the transition via /ca:task.

How

• _taskboardlib.classify_board_diff — a pure classifier that recognizes a clean done-flip / start-flip / single queued-add vs an arbitrary board edit (tight: state-cell + date only, no description ride-along; single-contiguous-insert for adds).
• commit-gate Phase 6 retains a classified transition instead of flagging it as scope creep; Phase 7 stages it by explicit path. The secret/crypto/migration gates are untouched — an arbitrary open-tasks.md edit still flags.
• Raise-new harvest moved to Phase 7 (pre-commit) so a discovered follow-up rides the work commit (contingent default); a must-survive follow-up is filed as a GitHub issue, not the board.
• /ca:standup gains a read-only, best-effort advisory drift sweep (hooks/boardsync.py reconcile) surfacing any merged-but-not-flipped task; the fix still routes through /ca:task (never auto-flipped).
• Docs in lockstep: commit-gate/SKILL.md, harvest.md, /ca:task doc.

Verification

• 10 plan tasks, all shipped test-first; new coverage in test_taskboardlib.py (classifier / id-extract / drift), test_boardsync.py (read-only byte-identical proof), and structural test_board_sync.py (registered in tech-stack + CI).
• Full tech-stack suite green; hooks/tests discover green; plugin-ref graph intact.
• Security review PASS — 0 CRITICAL/HIGH/MEDIUM; the exemption was confirmed non-bypassing and boardsync.py write-free/injection-free. One LOW (unguarded main() I/O) hardened.
• Caught and fixed silent LF→CRLF drift on standup.md before it bloated the diff.

Notes

• Folds into the unreleased 2.6.0 (payload already ahead of tag v2.5.2; no over-bump). CHANGELOG updated.
• Conflict-hierarchy level of the tradeoff: maintainability / reliability (SMARTS, per ADR-0008).
• Dogfoods its own rule: this PR stages the harvested docs-site-mirror task into open-tasks.md within the work commit.
• Fast-follow tracked on the board: sync the site/ command-doc mirrors for task.md/standup.md.

Closes #142

https://claude.ai/code/session_018n3e8e2RWU7hLzzJjEAscb