Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

prompts/implement.md

@@ -18,6 +18,13 @@ Before starting any work, you MUST run:
 
 If this reports FORBIDDEN artifacts, STOP. Do not proceed. Report the violation.
 
+## Pre-Edit Check (MANDATORY)
+Before modifying any file, verify the edit is allowed:
+  python ~/.automaton/scripts/status.py --can-edit --task {task-name} --file <file-path> --project {project}
+
+If this returns DENIED, STOP. Create a task or transition an existing one to implement phase first.
+Never edit files without an active implement-phase task.
+
 ## Task
 
 {task-description}