feat(tools): propose_scope recalibration valve for the execution loop

When a write is blocked for being outside the claimed task's
affected_paths, the implementer can propose widening scope via a new
T2 propose_scope tool. The operator decides (invariant #4 — the agent
can't self-grant). Approve unions the proposed paths into the task's
affected_paths (existing TaskAffectedPathsSetEvent); activeScope
re-derives the wider manifest from events so the same write then passes.
Reject blocks the task (via TaskClaimCoordinator.blockActiveTask, hooked
on both approval-denial branches, scoped to propose_scope) so the loop
advances. No new event types.

apps/server/src/main/kotlin/com/correx/apps/server/tasks/DefaultTaskClaimCoordinator.kt

@@ -26,4 +26,8 @@ class DefaultTaskClaimCoordinator(
 
     override fun activeScope(sessionId: SessionId): List<String> =
         taskService.activeClaim(sessionId.value)?.state?.affectedPaths ?: emptyList()
+
+    override suspend fun blockActiveTask(sessionId: SessionId, reason: String) {
+        taskService.activeClaim(sessionId.value)?.let { taskService.block(it.taskId, reason) }
+    }
 }