feat(07-01): wire task quality gates into all creation paths

- Add SaveTaskResult type to contracts.ts (id + optional capabilityWarning)
- IPC handler: validate new tasks, reject with TASK_VALIDATION_FAILED, check capability match
- API server: validate POST /issues and meeting action items before db.saveTask
- Automation service: validate create_task action, skip with warning if invalid
- CapabilityMatchDb interface uses optional skill methods for graceful degradation
- TypeScript compiles cleanly across all process boundaries
- All 241 tests pass with zero regressions

src/shared/contracts.ts

@@ -518,6 +518,11 @@ export type DesktopResult<T> =
   | { ok: true; data: T }
   | { ok: false; error: { code: string; message: string } };
 
+export interface SaveTaskResult {
+  id: string;
+  capabilityWarning?: string;
+}
+
 export type DesktopApi = {
   loadSnapshot: () => Promise<DesktopResult<ProfileSnapshot>>;
   pickDirectory: () => Promise<DesktopResult<string | null>>;
@@ -531,7 +536,7 @@ export type DesktopApi = {
   requestHire: (input: z.infer<typeof hireRequestSchema>) => Promise<DesktopResult<{ agentId: string; approvalId: string; autoApproved: boolean }>>;
   saveGoal: (input: z.infer<typeof goalInputSchema>) => Promise<DesktopResult<string>>;
   saveProject: (input: z.infer<typeof projectInputSchema>) => Promise<DesktopResult<string>>;
-  saveTask: (input: z.infer<typeof taskInputSchema>) => Promise<DesktopResult<string>>;
+  saveTask: (input: z.infer<typeof taskInputSchema>) => Promise<DesktopResult<SaveTaskResult>>;
   requestApproval: (input: z.infer<typeof approvalInputSchema>) => Promise<DesktopResult<string>>;
   decideApproval: (input: z.infer<typeof approvalDecisionSchema>) => Promise<DesktopResult<boolean>>;
   saveSecret: (input: z.infer<typeof secretInputSchema>) => Promise<DesktopResult<string>>;