feat(tasks): give task rows a canonical record identifier

Every work-record type carried a stable identifier except tasks, whose rows held
only id, workplan_id, title, status and priority — nothing connecting a row to
CUST-WP-0067-T01 in the file it came from. Matching was therefore by title, so a
renamed heading looked like one task vanishing and another appearing, and the
forge-derived reset had to refuse to touch tasks at all.

Adds tasks.record_id (nullable: no migration can invent an identity for an
existing row) and a backfill that reads the pairing from the repository files,
where a task declares both its canonical id and its projection UUID. 5516 pairs
across 121 repositories with zero conflicts; 4456 of 6073 cache task rows
identified.

Diff and reset now key on record_id where present, falling back to a
title-prefixed key so an unidentified row stays visibly unidentified.

Unknown stays unknown: a row the files do not claim keeps no identity and the
reset keeps refusing to act on it, and an existing identity is never
overwritten — a mismatch is recorded as a conflict rather than resolved.

Refs STATE-WP-0083-T06

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

api/services/forge_projection.py

@@ -350,11 +350,19 @@ def diff_against_hub(
             cur = have_wp.get(w.record_id.strip().lower())
             if cur:
                 hub_rows = hub_tasks_by_workplan.get(str(cur["id"]), [])
-        # Tasks carry no canonical id on the hub, only a title, so compare on
-        # title. Imperfect, and the reason task removal needs the same explicit
-        # acknowledgement as everything else.
-        have = {(t.get("title") or "").strip().lower(): t for t in hub_rows}
-        want = {(t.title or t.record_id).strip().lower(): t for t in w.tasks}
+        # Match on the canonical record id where the hub has one. Rows created
+        # before STATE-WP-0083-T06 fall back to title, which is why those are
+        # reported rather than acted on: a renamed heading is indistinguishable
+        # from a replaced task under title matching.
+        def _task_key(record_id: str | None, title: str | None) -> str:
+            if record_id:
+                return record_id.strip().lower()
+            return "title:" + (title or "").strip().lower()
+
+        have = {
+            _task_key(t.get("record_id"), t.get("title")): t for t in hub_rows
+        }
+        want = {_task_key(t.record_id, t.title): t for t in w.tasks}
         for key, t in want.items():
             if key not in have:
                 d.missing.append(
@@ -530,6 +538,7 @@ async def reset_repository_projection(
                     Task(
                         id=uuid.UUID(t.uuid),
                         workplan_id=row.id,
+                        record_id=t.record_id,
                         title=t.title or t.record_id,
                         status=t.status or "todo",
                         priority=t.priority or "medium",