#171: Align passive authentication mapping tasks

[justsml]

Summary

• maintain one canonical project-and-target mapping task across chat threads, while recording the nullable source thread and requested source task as explicit report provenance
• persist requested source-task attribution in Artifact metadata and carry it through mapping, follow-up, and negative-coverage metadata
• validate exported completion calls against the canonical mapping task role, summary target, and persisted report project/thread/target/task/source-task attribution before any reconciliation
• serialize PostgreSQL start and completion paths with a transaction-scoped project/target advisory lock, protecting both first-start identity and negative-result current-key revision; SQLite retains its serialized transaction behavior
• link completed mapping tasks to their report, current durable blockers, and current negative-coverage records
• record unblocked zero-route results as no-finding; keep blocked zero-route and medium-only signals inconclusive, never Findings
• supersede stale negative coverage when stronger evidence arrives and resolve stale workflow blockers when a clean retry clears them, retaining both histories
• create distinct passive-review and approval-required follow-up tasks while explicitly leaving both unscheduled
• commit blockers, negative-result reconciliation, mapping status, and follow-up tasks in one database transaction; concurrent retries converge on one state and a failed completion rolls back all database changes

Safety

This slice is passive-only. It does not enqueue scheduler work, run probes, grant approvals, or create findings. Approval-required work is represented as a durable todo task with executionPolicy: not-scheduled.

Verification

• pnpm exec vitest run --config vitest.integration.config.ts tests/integration/passive-auth-task-alignment.test.ts tests/integration/discovery-artifact-normalizer.test.ts tests/integration/passive-auth-blockers.test.ts tests/integration/negative-results.test.ts (22 tests)
• PostgreSQL-shaped advisory-lock regression at the exported mapping-lock seam
• canonical task/summary/report attribution rejection regressions
• concurrent retry and forced-write rollback regressions
• pnpm typecheck
• targeted Biome lint/check and diff checks

Stacked on #169. Closes #171.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Shorten and measure the reconciliation transaction, avoid reading the whole task board, and retain #181's human-authoritative gate. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.