Add authoritative full-run AV shadow finalization

[sneakocom]

Summary

• add the shipped Tasks shadow hook using AV native classification
• bind task, execution, plan, policy, catalog, source, package, and shadow identities
• return validated AV receipts through the normal capability channel
• preserve OBSERVE/SHADOW with full-run evidence and no savings claim

Verification

• npm run verify
• compatibility gate against Opsle Tasks b76d6253b405469b79d30b260f7ad09827052a4a
• repair-diff gitleaks scan: no findings