Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures

Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.

src/activity_core/context_resolvers/forgejo_prune.py

@@ -29,17 +29,30 @@ def forgejo_package_prune(params: dict[str, Any]) -> dict[str, Any]:
     if apply:
         cmd.append("--apply")
 
-    # ACTIVITY-WP-0020: worker pods often lack kubectl, so live-tag protection
-    # must come from an explicit multi-cluster image list file (hostPath).
+    # ACTIVITY-WP-0020 / 0023-T03: worker pods often lack kubectl, so live-tag
+    # protection must come from an explicit multi-cluster image list file.
+    # Apply is refused without a non-empty protection file (prevents the
+    # 2026-07-21 incident that deleted live state-hub tags).
     live_images = params.get("live_images_file") or os.environ.get(
         "FORGEJO_LIVE_IMAGES_FILE", ""
     )
+    live_path: Path | None = None
     if live_images:
         live_path = Path(str(live_images)).expanduser()
-        if live_path.is_file():
+        if live_path.is_file() and live_path.stat().st_size > 0:
             cmd.append(f"--live-images-file={live_path}")
+        elif apply:
+            raise RuntimeError(
+                f"forgejo_package_prune apply=true requires a non-empty "
+                f"live_images_file; missing or empty: {live_path}"
+            )
         else:
-            logger.warning("live_images_file not found: %s", live_path)
+            logger.warning("live_images_file not found or empty: %s", live_path)
+    elif apply:
+        raise RuntimeError(
+            "forgejo_package_prune apply=true requires params.live_images_file "
+            "or FORGEJO_LIVE_IMAGES_FILE (non-empty multi-cluster image list)"
+        )
 
     env = os.environ.copy()
     completed = subprocess.run(