Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures

Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.

activity-definitions/weekly-coding-retro.md

@@ -1,7 +1,7 @@
 ---
 id: weekly-coding-retro
 name: Weekly Coding Retrospection
-enabled: true
+enabled: false
 owner: custodian-agent
 governance: custodian
 status: proposed

activity-definitions/weekly-sbom-staleness.md

@@ -50,15 +50,16 @@ report_sinks:
     topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a
 ```
 
-Task emission for stale repos is **disabled** while IssueSink→Forgejo is
-policy/token broken (ACTIVITY-WP-0021). Re-enable the rule below once
-`ISSUE_SINK_TYPE=rest` (or `state-hub`) is proven healthy again.
+Task emission uses the fleet default sink (`ISSUE_SINK_TYPE=state-hub` —
+ACTIVITY-WP-0022): stale repos spawn `activity_task_spawn` progress events,
+not Forgejo issues. The deterministic instruction always posts a
+`sbom_staleness` summary for operators.
 
 ```rule
 id: flag-stale-sbom
 for_each: context.repos.repos
 bind_as: repo
-condition: 'false'
+condition: 'context.repo.sbom_age_days > 30'
 action:
   task_template: Run SBOM rescan for {context.repo.repo_slug}
   target_repo: context.repo.repo_slug