[e7d5fb64] Assignment-path capability refusal (delegate, reassign, admin set)

[roboco-app]

Extend the role-transition map the enforcement layer already owns (do NOT invent a parallel capability system) with a capability check invoked on every assignment path: delegate, reassign, and the admin task-set path. When a task would be assigned to an agent whose role cannot act on the status it will hold, refuse at creation time and name the missing capability in the refusal reason (use the existing not_authorized error category with a capability-naming message — the intake leaves this choice to the cell). This covers the 54e30535 wedge shape (task assigned to a product-owner id with no delivery verbs, nobody could act). Business logic and DB writes belong in roboco/services per the architectural standard; routes stay thin. Confirm the exact module that owns the role-transition map and extend it there.

[github-actions]

Thanks for opening your first pull request on RoboCo!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• make quality — ruff format check, ruff check, mypy, pytest (≥80% coverage), and the rest of the gate
• Panel changes pass pnpm lint and pnpm exec tsc --noEmit (run from panel/)
• No # noqa / # type: ignore shortcuts; pre-existing violations in touched files are fixed
• Added an entry under ## [Unreleased] in CHANGELOG.md
• Signed the CLA (the bot will prompt you on this PR)
• Signed your commits — master requires verified signatures (SSH signing setup)
• Updated any affected docs under docs/

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Welcome aboard — a maintainer will review shortly.