Link tasks to commits #299

A task is usually implemented over several commits, plus fixes and reviews. Record them so people in the web app and agents without a checkout can go from a task to its code: what changed, whether a half-done task has progress, what a reopened task touched. git log --grep covers the other direction only inside a local clone.

Tasks only, on purpose: memories and pages reach their commits through relations to the task (pages join the relation graph in #300); "checked against which source state" for memories and pages is #301 under #216, not here.

Design

• Own table (task ↔ commit), not a field and not ProjectItemRelation, whose endpoints are item numbers. Reuse its shape: provenance, created by user/agent, created at.
• Stored per link: full SHA (lowercase, 40 or 64 hex characters for SHA-1 and SHA-256 repositories), the repository as it was when linked (so a later remote change or fork does not repoint old links), creator and time. No free-text description: it would need review on shared projects and a link to the host shows the message anyway.
• Validation: MCP requires the full SHA (agents get it with git rev-parse HEAD). The web may accept an abbreviated SHA of at least 7 characters and rejects it as a duplicate when it is a prefix of an existing link or the reverse. The server never claims a commit exists.
• Permissions: linking and unlinking need edit permission on the task, like explicit relations; no review. Links follow the task's visibility and never grant access.
• MCP, no new tool (tool list is at its budget of 27, #282): task_complete and task_patch accept commits to add and removeCommits to remove; item_get and task_list detail return them.
• Web: commits on the task detail page, newest first, short SHA shown. A link to the host (GitHub commit URL) only when the stored repository matches a verified project remote; otherwise plain text. Add and remove from the task editor.

Acceptance

• Several commits per task; linking the same SHA twice is idempotent; abbreviated/full duplicates are rejected.
• Invalid SHAs fail with a message naming the expected format.
• Readers without access to the task see neither its commits nor that links exist; public projects expose only links of public tasks.
• Changing the project remote leaves existing links pointing at their original repository.
• Tool count test still passes; system guide tells agents to pass their commits to task_complete.
• #287 documentation (or a new page under Architecture) describes commit links.