fix(workflow): cross-profile decision-lock cleanup and irrecoverable provenance (#709)

Prevent merger-local empty decision locks from standing in for reviewer
terminal cleanup, refuse silent re-init overwrite of unresolved terminal
evidence, record post-merge recovery-required state when audit fails, and
add a truthful irrecoverable-provenance path that never claims applied=true.

Closes #709

task_capability_map.py

@@ -127,6 +127,15 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.review",
         "role": "reviewer",
     },
+    # #709: truthful absence-of-proof recovery record (not applied cleanup).
+    "record_irrecoverable_decision_lock_provenance": {
+        "permission": "gitea.issue.comment",
+        "role": "reconciler",
+    },
+    "gitea_record_irrecoverable_decision_lock_provenance": {
+        "permission": "gitea.issue.comment",
+        "role": "reconciler",
+    },
     "delete_branch": {
         "permission": "gitea.branch.delete",
         "role": "author",