A1: propagate taskId through pilo server and core

[MrTravisB]

Summary

First PR in Stack A of the Pilo reliability plan. Adds a server-generated
taskId (UUID v4) that threads through every task submitted via
POST /pilo/run (SSE) or the WebSocket /pilo/run endpoint.

The taskId:

• Is exposed as an x-pilo-task-id HTTP response header on every response
  (success, validation error, setup error) so callers like tabs-api can log
  the taskId with the request in their access log without parsing the SSE body
• Is returned in the SSE start event and a new WebSocket task:accepted event
• Is echoed in every error response (validation, setup, task-execution) as an
  optional error.taskId field
• Threads through runTask into WebAgent options and is set as the
  pilo.task.id OTel span attribute on the root task span

Purely observational. No behavior change. Additive only: the new
error.taskId field is optional, the new task:accepted WS event and
x-pilo-task-id header are new, so existing clients are unaffected. Unblocks
downstream PRs that need per-task correlation in logs, metrics, and traces.

Changes

• packages/core/src/webAgent.ts - optional taskId on WebAgentOptions,
  set as pilo.task.id span attribute
• packages/server/src/taskRunner.ts - optional taskId on
  TaskRunnerOptions and ErrorResponse.error;
  createErrorResponse(message, code, taskId?) signature
• packages/server/src/routes/pilo.ts - generate taskId at request entry,
  set x-pilo-task-id response header, include in start event and all
  error responses, pass to runTask
• packages/server/src/routes/piloWs.ts - generate taskId on task:details,
  emit task:accepted event, include in all error responses, pass to runTask
• Tests added: 3 in taskRunner.test.ts, 7 in pilo.test.ts, 4 in piloWs.test.ts

Test plan

• pnpm --filter pilo-server run test (70 passing: 56 existing + 14 new)
• pnpm --filter pilo-core run test (658 passing)
• pnpm --filter pilo-cli run test (221 passing)
• pnpm run typecheck green across all packages
• pnpm run format:check green
• Manual: curl -i -X POST /pilo/run -d '{}' returns 400 with an
  x-pilo-task-id response header and error.taskId in the body, both
  matching the same UUID v4
• Manual: WS task:details returns task:accepted event with taskId
  before any agent events

Notes

• Base branch: main
• Draft PR since this is the first of a multi-PR stack (Stack A: A1-A4)
• A2 next: replace errorToString with a sanitized structured error shape
  (class + reason enum, never error.message)
• gitleaks is not installed on my machine - I couldn't run the recommended
  secret scan, but the diff contains only UUID propagation and test values
  like "task-abc-123", no secrets