fix: audit deferred Taskfile commands

[rogerchappel]

Summary

• include Taskfile v3 defer mappings in each task command and its risk evidence
• fail closed on unsupported or malformed cmds entries with a file- and entry-specific diagnostic
• document supported Taskfile command shapes and fail-closed behavior

Commits

• e862e05 test: cover deferred Taskfile commands
• b26947f fix: audit deferred Taskfile commands
• 73f99fb docs: define Taskfile command discovery

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• regression tests failed before implementation and passed afterward
• npm run release:check (39 tests, typecheck, build, smoke, package dry run, release workflow check)
• git diff --check origin/main...HEAD
• all commit authors and committers verified as Roger Chappel <miscanalysis@gmail.com>

[rogerchappel]

Automated merge note

Triage class: auto-merge

Summary: Includes Taskfile deferred-command mappings in compound audit evidence and fails closed on malformed command entries, with focused regression coverage and documentation (4 files, +53/-9).

Checks run: GitHub CI Repository hygiene — COMPLETED/SUCCESS; worker verification recorded npm ci --ignore-scripts --no-audit --no-fund, regression tests, npm run release:check (39 tests, typecheck, build, smoke, package dry run, release workflow check), and git diff --check. Final full diff, mergeability, branch protection, exact Roger Chappel author/committer identities, and head SHA re-verified.

Rebased/CI-repaired: No.

Verified head SHA: 73f99fb.