Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures

Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.

src/activity_core/worker.py

@@ -113,23 +113,51 @@ async def run() -> None:
         ],
     )
 
-    task_worker = Worker(
-        client,
-        task_queue=TASK_EXECUTION_TASK_QUEUE,
-        workflows=[TaskExecutorWorkflow],
-        activities=[persist_task_instance],
-    )
+    # ACTIVITY-WP-0023-T08: only register the legacy task-execution stub when
+    # explicitly enabled. Default is orchestrator-only so production does not
+    # advertise a fake execution surface on task-execution-tq.
+    enable_task_stub = os.environ.get(
+        "ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB", ""
+    ).strip().lower() in {"1", "true", "yes", "on"}
+
+    task_worker: Worker | None = None
+    if enable_task_stub:
+        task_worker = Worker(
+            client,
+            task_queue=TASK_EXECUTION_TASK_QUEUE,
+            workflows=[TaskExecutorWorkflow],
+            activities=[persist_task_instance],
+        )
+        logger.warning(
+            "TaskExecutorWorkflow stub ENABLED on %s — not for production execution",
+            TASK_EXECUTION_TASK_QUEUE,
+        )
+    else:
+        logger.info(
+            "TaskExecutorWorkflow stub not registered "
+            "(set ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB=true for legacy tests only)"
+        )
 
     loop = asyncio.get_running_loop()
     stop = asyncio.Event()
     loop.add_signal_handler(signal.SIGTERM, stop.set)
     loop.add_signal_handler(signal.SIGINT, stop.set)
 
-    async with orchestrator_worker, task_worker:
+    workers = [orchestrator_worker]
+    if task_worker is not None:
+        workers.append(task_worker)
+
+    from contextlib import AsyncExitStack
+
+    async with AsyncExitStack() as stack:
+        for w in workers:
+            await stack.enter_async_context(w)
+        queues = [ORCHESTRATOR_TASK_QUEUE]
+        if enable_task_stub:
+            queues.append(TASK_EXECUTION_TASK_QUEUE)
         logger.info(
-            "Workers running — queues: %r, %r (namespace=%r)",
-            ORCHESTRATOR_TASK_QUEUE,
-            TASK_EXECUTION_TASK_QUEUE,
+            "Workers running — queues: %r (namespace=%r)",
+            queues,
             TEMPORAL_NAMESPACE,
         )
         await stop.wait()