Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

tasks/plug-stale-task-hole/ADVERSARIAL_BUG_REPORT.md

@@ -0,0 +1,14 @@
+# Adversarial Bug Report — plug-stale-task-hole
+
+## Attack Vectors
+1. **Clock reset bypass**: Can an attacker manipulate the activity clock to bypass stale detection?
+2. **False positives**: Can legitimate activity be misclassified as stale?
+3. **Race condition**: What happens if --touch and --can-edit race on the task's timestamp?
+
+## Findings
+- The activity clock uses filesystem mtime, which IS manipulable by `touch` — but this is by design (the `--touch` command is the official way to reset)
+- The 30-minute threshold gives reasonable headroom for long-running work
+- Race conditions are minimal since status.py uses atomic file operations
+
+## Verdict
+No exploitable vulnerabilities found.