Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.
Filed from issue-core ISSUE-WP-0004-T05 / CUST-WP-0060 item 6. Default
IssueSink must not silently create Forgejo issues for internal findings.
Registered in state-hub via fix-consistency (UUIDs written back).