feat: implement ISSUE-WP-0005 connector mapping and scope alignment

Add MappingService (work_record_uuid ↔ external id), project/map CLI with
outward push-status, optional TaskSpec work_record fields, boundary-sync
policy, and packaging/capability framing cleanup. Mark WP-0005 finished.

tests/test_api_ingest.py

@@ -189,6 +189,42 @@ def test_ingest_persists_traceability_metadata(client, valid_payload, tmp_issue_
         backend.disconnect()
 
 
+@pytest.mark.unit
+def test_ingest_with_work_record_uuid_creates_mapping(client, valid_payload, tmp_issue_store):
+    wr = str(uuid.uuid4())
+    valid_payload["work_record_uuid"] = wr
+    valid_payload["work_record_id"] = "ISSUE-WP-0005-T06"
+    valid_payload["work_record_kind"] = "task"
+    response = client.post(
+        "/issues/",
+        json=valid_payload,
+        headers={"Authorization": f"Bearer {API_KEY}"},
+    )
+    assert response.status_code == 201, response.text
+    issue_id = response.json()["issue_id"]
+
+    from issue_core.core.mapping import MappingService
+
+    svc = MappingService()
+    svc.connect(str(tmp_issue_store / "mappings.db"))
+    try:
+        mapping = svc.get_active_by_uuid(wr, backend="sqlite")
+        assert mapping is not None
+        assert mapping.external_id == issue_id
+        assert mapping.work_record_id == "ISSUE-WP-0005-T06"
+    finally:
+        svc.disconnect()
+
+    # Idempotent second post returns same issue
+    response2 = client.post(
+        "/issues/",
+        json=valid_payload,
+        headers={"Authorization": f"Bearer {API_KEY}"},
+    )
+    assert response2.status_code == 201
+    assert response2.json()["issue_id"] == issue_id
+
+
 @pytest.mark.unit
 def test_app_refuses_without_api_key_env(monkeypatch, tmp_issue_store, valid_payload):
     monkeypatch.delenv("ISSUE_CORE_API_KEY", raising=False)