fix: refuse task check declarations the completion gate cannot approve

[ZeroPoint95]

• Fixed task admission and check replacement to reject declarations the existing completion gate cannot approve, before changing the plan or starting a review.
• Reused the completion gate's predicate for batch admission, review-check admission, and replacement. Commands are refused rather than split, rewritten, or dropped.
• Added guidance to declare one command per --check and use paths from the task-copy root.
• Preserved unrelated edits to older tasks and the requirement for each declared check to have recorded zero-exit evidence.
• Added CLI and store regressions for invalid declarations, atomic rollback, quoted text, separate commands, legacy records, and review contracts independent of recorded work.

Validation:

• make build and BASE=4ca96427bc27a764be98940b9d6cb805c08642f0 make pr-ready passed on 47a3483, including fresh full plan-store and supervisor suites; no attributed warnings.
• Independent review approved the repair and the rebased candidate with no blocking findings.
• Real binary admission smoke passed: invalid add/replacement caused no store changes; separate flags and quoted text were preserved.
• Hosted-drive acceptance passed: 14 PASS / 0 FAIL with unchanged bounds. A targeted live hosted task then exercised compound rejection, same-ID correction, automatic checker execution of go build ./... and go test -count=1 ./..., two recorded zero-exit receipts, and run-based completion. Hosted completion was observed at 130 seconds within the original 300-second bound.
• The live proof used commit 7632d7ead. Its six repair files remain byte-identical after rebasing onto the merged senior-dev repair.