feat(SDD-012): backlog-integrity guard for vault task files

[mlorentedev]

What

Ships the root-fix for backlog drift: a guard that enforces one ticket = one entry so 11-tasks.md can't silently re-diverge after a cleanup. Sibling of SDD-006 (check-md-escapes.sh) — same incident→guard shape.

The drift it prevents: a sprint-overview view was layered on top of the older detailed entries, so 34 ticket IDs appeared 2+ times and the views disagreed (e.g. IDEAS-007/SDD-004 marked both open and done; the count read 63 open vs ~35 real).

How

• scripts/check-backlog-integrity.sh — takes <tasks-file>..., flags per file: DUPLICATE (same ID on 2+ entry lines) and CONTRADICTION (same ID marked both [ ] and [x]). Exit 0/1/2. No Obsidian dep. Portable (sed -nE + plain awk, no gawk-only features). Greedy [a-z]? keeps WIN-002a distinct from WIN-002.
• scripts/vault.sh — new vault check-tasks <path>... dispatch.
• scripts/vault-health.sh — new GUI-independent section 7/7 Backlog Integrity scanning every 10_projects/*/11-tasks.md, so the drift auto-surfaces at SessionStart.
• tests/check-backlog-integrity.bats — 6 fixture tests (dup, contradiction, clean+sub-id, usage, missing, dispatcher).

Verification

• bats tests/check-backlog-integrity.bats → 1..6 all ok
• shellcheck + bash -n clean on all 3 scripts
• Real-data smoke: run against the live 11-tasks.md → exit 1, 30 duplicates + 3 contradictions correctly identified (proves it works on production data, not just fixtures)

Acceptance criteria

• AC1 duplicate IDs flagged · [x] AC2 status contradictions flagged · [x] AC3 clean passes + sub-ids safe · [x] AC4 wired (dispatcher + vault-health section)
• AC5 (real backlog consolidated to green) — deferred follow-up (vault checkout was busy with a parallel session). Today the guard intentionally exits 1 on the real file: that IS it surfacing the drift to be consolidated.

SDD

• Spec: specs/SDD-012-tasks-integrity-guard/ (scaffolded with --force-no-vault — vault busy; the SDD-012 backlog entry + consolidation land in the AC5 follow-up, tracked in the spec, not skipped)
• Sibling precedent: specs/archive/SDD-006-vault-integrity-check/