fix: anti-stomp capability auth, inventory wiring, side-effect proof (#604)

Address REQUEST_CHANGES on PR #680:

Blocker A — role vs capability agreement
- authorization_compatible allows reviewer/merger when they hold the task's
  required permission (e.g. gitea.issue.comment on comment_issue/mark_issue/
  set_issue_labels/lock_issue) without broad role-bypass.
- Unauthorized escalation without the permission remains fail closed.
- Regression coverage for allowed and denied reviewer/merger cases.

Blocker B — MUTATION_TASKS matches runtime wiring
- Remove unenforced entries; document dedicated-gate exclusions
  (mark_final_review_decision, save/resume_review_draft, etc.).
- Wire non-closing gitea_edit_pr as edit_pr; acquire lease uses
  acquire_reviewer_pr_lease task through verify_preflight_purity.
- Inventory↔wiring consistency tests replace set-membership-only coverage.

Blocker C — entrypoint side-effect ordering
- Behavioral tests for merge_pr, submit_pr_review, and comment_issue prove
  the assessor block aborts before Gitea API mutation and local durable writes.

Validation: 43 focused anti-stomp + related suites green; full suite
2639 passed / 6 skipped.

Closes #604

task_capability_map.py

@@ -60,6 +60,15 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.close",
         "role": "author",
     },
+    # Non-closing PR metadata edits (title/body/base). Closing uses close_pr.
+    "edit_pr": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
+    "gitea_edit_pr": {
+        "permission": "gitea.pr.create",
+        "role": "author",
+    },
     "address_pr_change_requests": {
         "permission": "gitea.branch.push",
         "role": "author",
@@ -68,10 +77,22 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.review",
         "role": "reviewer",
     },
+    "submit_pr_review": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
     "merge_pr": {
         "permission": "gitea.pr.merge",
         "role": "merger",
     },
+    "acquire_reviewer_pr_lease": {
+        "permission": "gitea.pr.comment",
+        "role": "reviewer",
+    },
+    "gitea_acquire_reviewer_pr_lease": {
+        "permission": "gitea.pr.comment",
+        "role": "reviewer",
+    },
     "adopt_merger_pr_lease": {
         "permission": "gitea.pr.comment",
         "role": "reviewer",