checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

internal/store/store.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"orchestra/internal/authz"
 	"orchestra/internal/domain"
 	"os"
 	"path/filepath"
@@ -45,6 +46,10 @@ func Open(dir string) (*Store, error) {
 			s.external[t.Source+"\x00"+t.ExternalID] = t.ID
 		}
 		snapshotSeq = snap.Seq
+		// Continue event numbering after the snapshot. Without restoring this
+		// cursor, the first append after a restart reused sequence 1 and made
+		// the append-only log unreplayable.
+		s.seq = snapshotSeq
 	} else if !errors.Is(readErr, os.ErrNotExist) {
 		return nil, readErr
 	}
@@ -160,9 +165,6 @@ func (s *Store) apply(e domain.Event) error {
 func (s *Store) Append(e domain.Event) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if err := domain.ValidateEvent(e); err != nil {
-		return err
-	}
 	if e.At.IsZero() {
 		e.At = time.Now().UTC()
 	}
@@ -172,6 +174,15 @@ func (s *Store) Append(e domain.Event) error {
 	if e.SchemaVersion == 0 {
 		e.SchemaVersion = domain.CurrentEventSchema
 	}
+	if err := domain.ValidateEvent(e); err != nil {
+		return err
+	}
+	// Enforced once, at the append boundary, per spec §7.1/invariant 4 — every
+	// producer (HTTP handler, router, coordinator, provider, federation relay)
+	// must declare its Surface here; there is no separate in-process bypass.
+	if err := authz.AuthorizeEvent(authz.Surface(e.Surface), e.Type); err != nil {
+		return err
+	}
 	if e.Type == "TaskCreated" {
 		var p map[string]any
 		if err := json.Unmarshal(e.Payload, &p); err != nil {
@@ -327,7 +338,7 @@ func (s *Store) Lease(id, harness string, ttl time.Duration) (domain.Event, erro
 		return domain.Event{}, domain.ErrConflict
 	}
 	p, _ := json.Marshal(map[string]any{"harness_id": harness, "ttl": ttl.Seconds(), "until_ns": time.Now().Add(ttl).UnixNano(), "expected_version": t.Version})
-	e := domain.Event{ID: id, Type: "TaskLeased", TaskID: id, Version: t.Version + 1, Payload: p}
+	e := domain.Event{ID: id, Type: "TaskLeased", TaskID: id, Version: t.Version + 1, Payload: p, Surface: string(authz.System)}
 	return e, s.Append(e)
 }
 
@@ -336,7 +347,7 @@ func (s *Store) ExpireLeases(now time.Time) ([]domain.Event, error) {
 	for _, t := range s.Tasks() {
 		if t.State == domain.StateLeased && t.Lease != nil && !t.Lease.Until.After(now) {
 			p, _ := json.Marshal(map[string]any{"reason": "lease_expired", "harness_id": t.Lease.HarnessID})
-			e := domain.Event{ID: t.ID, Type: "TaskReleased", TaskID: t.ID, Version: t.Version + 1, Payload: p}
+			e := domain.Event{ID: t.ID, Type: "TaskReleased", TaskID: t.ID, Version: t.Version + 1, Payload: p, Surface: string(authz.System)}
 			if err := s.Append(e); err != nil {
 				return out, err
 			}