2026.09.3: fix(check): enforce state uniqueness, projections, and required files

Review fixes for the first cycle, released as 2026.09.3:

- duplicate task_id across current task files -> TASK_ID_DUPLICATE error
- duplicate Active Tasks rows for one task -> TASK_RUNTIME_DUPLICATE error
- open task (draft/active/blocked/ready_for_review) without an Active
  Tasks projection row -> TASK_PROJECTION_MISSING error; closed
  (accepted/superseded) and legacy tasks are exempt (fail-closed)
- required-file check now covers project.md, governance.md, and
  tasks/README.md per the 10-vault required-structure list
- drop the unimplemented future max_bytes promise from the cycle plan;
  budget behavior unchanged (only explicit thresholds are enforced)

No new abstractions; three finding codes and one widened constant list.
87 tests total (4 new behaviors + fixture updates).