Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures

Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.

src/activity_core/workflows.py

@@ -214,26 +214,45 @@ class RunActivityWorkflow:
 
 @workflow.defn
 class TaskExecutorWorkflow:
-    """Compatibility stub for legacy task-instance workflows.
+    """LEGACY NO-OP — not a production execution surface (ACTIVITY-WP-0023-T08).
 
-    This is not a production execution surface for activity-core. It persists a
-    task_instances row with status=done and returns immediately so legacy/dev
-    flows keep their idempotency behavior. Real task execution belongs in
-    per-repo workers or a future execution-owned repo/workplan, not here.
+    Historical compatibility stub. Real task execution belongs in per-repo
+    workers / agent-harness, not activity-core.
 
-    task_id is derived deterministically from the workflow's own ID so
-    persist_task_instance retries remain idempotent.
+    Behaviour is controlled by ``ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB``:
+
+    - unset / false (default): refuse to run (logs error, raises) so the stub
+      cannot attract production work by accident.
+    - true: legacy behaviour — persist a done ``task_instances`` row for
+      idempotent dev/test callers only.
     """
 
     @workflow.run
     async def run(self, run_id: str, task_type: str, params: dict) -> dict:
-        # Keep the stub idempotent without implying task lifecycle ownership.
+        enabled = (
+            os.environ.get("ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB", "")
+            .strip()
+            .lower()
+            in {"1", "true", "yes", "on"}
+        )
         task_id = str(
             uuid.uuid5(uuid.NAMESPACE_URL, workflow.info().workflow_id)
         )
 
-        workflow.logger.info(
-            "TaskExecutorWorkflow started",
+        if not enabled:
+            workflow.logger.error(
+                "TaskExecutorWorkflow refused: stub disabled "
+                "(set ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB=true only for legacy tests). "
+                "Real execution belongs in per-repo workers / agent-harness. "
+                "See docs/task-emission-consumer-contract.md"
+            )
+            raise RuntimeError(
+                "TaskExecutorWorkflow is disabled (ACTIVITY-WP-0023-T08). "
+                "Use per-repo executors; do not route production work here."
+            )
+
+        workflow.logger.warning(
+            "TaskExecutorWorkflow stub running (legacy mode)",
             extra={"run_id": run_id, "task_type": task_type, "task_id": task_id},
         )
 
@@ -251,4 +270,4 @@ class TaskExecutorWorkflow:
             retry_policy=_RETRY_POLICY,
         )
 
-        return {"task_id": task_id, "status": "done"}
+        return {"task_id": task_id, "status": "done", "legacy_stub": True}