Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

tasks/actionable-phase-guidance/ADVERSARIAL_BUG_REPORT.md

@@ -0,0 +1,14 @@
+# Adversarial Bug Report — actionable-phase-guidance
+
+## Attack Vectors
+1. **Empty state**: What happens for an unknown/unexpected state value?
+2. **HTML injection**: Could guidance text contain user-controlled content that escapes sanitization?
+3. **Empty guidance**: Does the frontend handle missing/incomplete guidance gracefully?
+
+## Findings
+- Unknown states fall through to a generic return — safe, no crash
+- Guidance text is static (no user content), so injection is not a concern
+- Frontend checks `task.phase_guidance` truthiness before rendering the guidance section — safe
+
+## Verdict
+No vulnerabilities found. The implementation is defensive against all checked attack vectors.