WIP: add policy-gated Todoist task creation

[mzored]

Pause checkpoint

This draft preserves the current Unit 6 implementation for review and continuation. It is not ready to merge.

Implemented and locally verified so far:

• disabled-by-default independent Todoist configuration
• strict typed task candidates and delegated public_sender execution
• fixed minimized Todoist payload, deterministic UUID/temp ID, durable mapping, uncertain recovery, and administrative erasure deletion
• public-store-only no-authority capture
• isolated direct-owner candidate lookup
• atomic exact prepare and second-control confirmation in the Policy Gate
• bounded/standing authority and Calendar independence

Local evidence on exact head b2f1971:

• focused atomic acceptance: 12 passed
• affected Policy Gate/controller/public assistant suites: 281 passed
• exact full pytest: 829 tests, exit 0
• Black, isort, Flake8, strict mypy over all changed source files, and diff checks passed

Known merge blockers:

1. distinct tasks in one open Inbox thread can reuse a request ID and corrupt the candidate binding;
2. source edit/delete does not invalidate the immutable task candidate;
3. retry after a crash with an already durable successful mapping does not finish through the exact-confirm path, and production exposes no reconciliation route;
4. the v6-to-v7 migration retires unclaimed candidates too broadly.

Live Todoist scope/project enforcement, duplicate-UUID lost-response behavior, and repeated administrative deletion remain intentionally unverified because no credential or live provider was used.

[mzored]

Pause checkpoint on b2f19716f55f439418737b8503741a3b77bcb24e: this draft is preserved but blocked. Independent review found distinct-task request-ID reuse, stale candidate survival after source edit/delete, no production recovery route after a durable mapping/post-mapping crash, and an overbroad v6-to-v7 retirement query. CI run 33452187338 also failed only the macOS external-read broker subprocess test after 828 passes; Ubuntu was cancelled. Full details and resume order are in the private tracker. Do not merge or mark ready.