Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

tasks/port-pi-guard/IMPLEMENTATION.md

@@ -0,0 +1,18 @@
+# Port Guard to Pi Dev Implementation
+
+## Summary
+Created pi dev extension at `plugins/automaton-guard-pi/` using the `@earendil-works/pi-coding-agent` API.
+
+## Changes
+
+### New Files
+- `plugins/automaton-guard-pi/guard.ts` — Pre-edit guard for pi dev harness
+  - Intercepts `tool_call` events for edit/write/bash tools
+  - Calls `status.py --can-edit` before allowing file modifications
+  - Handles stale task detection with user notification
+  - Uses `child_process.execSync` for status.py invocation
+- `plugins/automaton-guard-pi/package.json` — Package manifest with pi-coding-agent peer dependency
+
+### Integration
+- `scripts/register-guards.sh` — Detects `pi` in PATH and installs the guard via `pi install`
+- `contracts/harness-integration.md` — Updated enforcement matrix to include Pi Dev