Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures

Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.

tests/test_issue_sink.py

@@ -81,6 +81,31 @@ def test_issue_core_rest_sink_posts_task_contract(monkeypatch) -> None:
     assert "review_required" not in posts[0]["json"]
 
 
+def test_default_sink_is_state_hub_not_rest(monkeypatch) -> None:
+    """ACTIVITY-WP-0022: unset ISSUE_SINK_TYPE must not open Forgejo/rest."""
+    from activity_core import issue_sink as mod
+
+    monkeypatch.delenv("ISSUE_SINK_TYPE", raising=False)
+    sink = mod.get_issue_sink()
+    assert type(sink).__name__ == "StateHubProgressSink"
+
+
+def test_unknown_sink_type_falls_back_to_state_hub(monkeypatch) -> None:
+    from activity_core import issue_sink as mod
+
+    monkeypatch.setenv("ISSUE_SINK_TYPE", "forgejo-please")
+    sink = mod.get_issue_sink()
+    assert type(sink).__name__ == "StateHubProgressSink"
+
+
+def test_rest_sink_still_available_when_explicit(monkeypatch) -> None:
+    from activity_core import issue_sink as mod
+
+    monkeypatch.setenv("ISSUE_SINK_TYPE", "rest")
+    sink = mod.get_issue_sink()
+    assert type(sink).__name__ == "IssueCoreRestSink"
+
+
 def test_issue_core_rest_sink_requires_api_key() -> None:
     sink = IssueCoreRestSink("http://issue-core.test/", api_key="")
     with pytest.raises(RuntimeError, match="ISSUE_CORE_API_KEY"):