checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

internal/domain/domain.go

@@ -17,7 +17,11 @@ var ErrConflict = errors.New("task version conflict")
 var ErrNotFound = errors.New("task not found")
 var ErrInvalid = errors.New("invalid event")
 
-const CurrentEventSchema = 1
+// CurrentEventSchema is 2: schema 2 requires every event to declare its
+// authorizing Surface (see ValidateEvent), enforced at the store append
+// boundary. Schema 1 events already on disk replay unchanged — tolerant
+// reader, not upcast (spec open question #2).
+const CurrentEventSchema = 2
 
 type TaskState string
 
@@ -63,6 +67,12 @@ type Event struct {
 	Version       int             `json:"version"`
 	At            time.Time       `json:"at"`
 	Payload       json.RawMessage `json:"payload"`
+	// Surface identifies the bus capability the emitter is authorized under
+	// (see internal/authz). It is required on every event so authorization is
+	// enforced once, at the store append boundary, regardless of whether the
+	// emitter reached the store over HTTP, from the router, from a harness
+	// adapter, or from a provider.
+	Surface string `json:"surface"`
 }
 
 func Hash(v []byte) string { h := sha256.Sum256(v); return hex.EncodeToString(h[:]) }
@@ -82,6 +92,9 @@ func ValidateEvent(e Event) error {
 	if e.SchemaVersion > CurrentEventSchema || e.Type == "" || e.TaskID == "" || len(e.Payload) == 0 || len(e.Payload) > 64*1024 {
 		return ErrInvalid
 	}
+	if e.SchemaVersion >= 2 && strings.TrimSpace(e.Surface) == "" {
+		return fmt.Errorf("%w: surface required", ErrInvalid)
+	}
 	allowed := map[string]bool{"TaskCreated": true, "TaskLeased": true, "TaskReleased": true, "TaskCompleted": true, "TaskFailed": true, "TaskBlocked": true, "ApprovalRequested": true, "ApprovalGranted": true, "ApprovalDenied": true, "TaskAmended": true, "QuotaReported": true, "StandupAdvisory": true}
 	if !allowed[e.Type] {
 		return fmt.Errorf("%w: unknown type %q", ErrInvalid, e.Type)