[euxaristia]

Closes #395

Summary

Gates agent-task read surfaces behind repo and task visibility rules while preserving open-claim workflows, applying rate limiting across REST and GraphQL WebSockets, and enforcing hostile-node response limits in the CLI and MCP client.

Changes

• GraphQL WebSocket Brake: Mount /graphql/ws with TaskReadBrake to enforce the 5-field cap and per-IP rate limits over subscriptions.
• Open-Claim Policy: Decouple task claim eligibility (task_claimable) from read visibility (task_visible) so open unassigned tasks can be claimed without exposing task bodies on unauthenticated read queries.
• CLI & MCP Identity Errors: Differentiate explicit key directory errors from missing default keypairs using load_optional_keypair, terminating before issuing network calls on invalid paths.
• Hostile Node Defenses: Bound task responses to 2 MiB before JSON deserialization, validate non-empty string IDs and page-local uniqueness before committing rows, and sanitize terminal cursor diagnostics.
• Denial & Isolation Tests: Add GraphQL denial test coverage for repo-less tasks and secret isolation.

Prior reviewer feedback addressed

• Wired /graphql/ws with TaskReadBrake context and added production router integration tests.
• Separated open-claim eligibility from read visibility and added 3-DID lifecycle coverage.
• Converted silent anonymous fallback on missing --dir to strict failure without network calls.
• Enforced byte budgets before deserialization and validated schema/continuation invariants before LimitReached.

Test plan

• cargo test -p gitlawb-core -p gl
• cargo clippy -p gl --all-targets -- -D warnings
• cargo clippy --workspace -- -D warnings
• cargo fmt --check