Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

prompts/orchestrate.md

@@ -20,6 +20,24 @@ You are the Orchestrator Driver. Your job is to act as a **state machine** for t
 
 VRAM configuration is in `~/.automaton/config.md`. If `Auto-detect: Yes`, run `python ~/.automaton/scripts/vram_detect.py`.
 
+## Task Creation (MANDATORY before any work)
+
+**Before making ANY code edits**, you MUST have an active task in implement or doc_review phase. If the user asks you to do something and no task exists:
+
+```
+python ~/.automaton/scripts/status.py --create-task <kebab-case-name> --project {project}
+python ~/.automaton/scripts/status.py --transition research --task <name> --project {project}
+python ~/.automaton/scripts/status.py --transition implement --task <name> --project {project}
+```
+
+If an existing task is in implement/doc_review but was created >30 minutes ago, the guard will block edits. Touch the task to reset its clock:
+
+```
+python ~/.automaton/scripts/status.py --touch --task <name> --project {project}
+```
+
+Never piggyback on a stale task — create a new one for new work.
+
 ## State Machine
 
 The full state machine is defined in ~/.automaton/prompts/workflow.md. Key points: