codeArbiter 2.5.0: task-board lifecycle + gate hardening

Added

• Advisory scope-touch detection for CI, deploy/IaC, and auth (H-15/H-16/H-17). After a
  write/edit, post-write-edit.py now reminds when a CI/CD workflow (H-15), a deployment/IaC
  manifest (H-16), or narrow high-signal auth logic (H-17) is touched, pointing at
  security-reviewer. These are advisory only — no commit block: a workflow runs only once merged
  and IaC bites only on apply, so a hard per-commit gate would impede iterative infra work while the PR
  review still catches the change (the irreversible-once-committed harms — secret/migration/crypto —
  keep their blocking gates). commit-gate now dispatches security-reviewer on a staged CI/deploy touch
  even on bare /commit / the small lane, closing the same lane-skip gap H-14 closed for migrations.
  CI and deploy paths are detected by default glob sets, extendable/narrowable via ci-paths /
  deploy-paths blocks in security-controls.md (same grammar as migration-paths); the migration,
  CI, and deploy detectors now share one path_in_globs matcher in _hooklib.py. Resolves the
  scope-touch half of #73. (#73)
• /ca:metrics — governance trend glance (issue #79). Read-only command computing override rate,
  small-lane rate, and sprint low-confidence ratio over 20-commit windows, each with a direction arrow
  (↑/↓/→) vs. the prior window. Optional --window N to adjust the window size. Bare numbers only —
  not a second /ca:audit packet; writes nothing.
• Task-board lifecycle + /ca:task writer and follow-up harvest (#118). open-tasks.md gains a
  kanban-style lifecycle ([ ] queued, [~] in-progress, [x] done) with content-bearing IDs, so
  the in-flight count and stale-task nudge read real state instead of counting every bullet. The board
  now surfaces malformed or undated entries at SessionStart rather than letting work silently drop off.
  New /ca:task add|start|done is the sanctioned board mutator, and each gated workflow's terminal
  step harvests its un-actioned residue (NEEDS-TRIAGE markers, the checkpoint DEFERRABLE table,
  low-confidence sprint decisions) into the durable backlog.

Fixed

• --farm setup-doc error messages now point at the file that actually ships (#119). The no-model
  and no-API-key guards cited a never-scaffolded .codearbiter/farm.md; they now point at
  ${CLAUDE_PLUGIN_ROOT}/includes/farm.md, which is part of the plugin payload.
• The crypto and secret commit gates now catch the Node/TS forms (#120). CRYPTO_RE detects the
  TypeScript TLS-verification-disable patterns (the rejectUnauthorized bypass and the Node TLS-reject
  env override), not only the Python form; and SECRET_RE matches object-literal secrets
  ("api_key": "…") plus high-entropy key prefixes (AKIA, ghp_, sk-ant-), not only =-style
  assignments. The farm.ts outbound redactor is aligned so the gate and the redactor never disagree.