feat(roles): coder drops the task.reassign grant the broker always refuses (#1567, row 73)

roles/coder.json crossRole goes from ["task.reassign", "task.scope.change"]
to ["task.scope.change"]. The broker refuses a non-pm task.reassign at the
writer check before it looks at authority, so the grant could never be
used. A coder's task.reassign now classifies as gated and goes to the
human. Backed by lead decision 90.

Tests: business role and resolve (the narrowing test moves to the pm,
which still holds two cross-role actions), a bus test on the shipped role
files, a harness test that a coder with a tracker gets no task_reassign,
the tasks fixture, and a verbs line showing a coder's task.reassign
refuses field-writer with no action.allowed. mutants.sh is Rocko's packet
rerun script, already committed.

Author: Rocko (packet agents/rocko/work/queue-73/, commit 2137dd7f).
Candidate manifest sha256 bf4e5ed6, base 324c064b, no drift on the
candidate paths through 8a42e819.
Approval: Dewey, round 1, comment 27506 on #1567.
Gate (Sage, /tmp/sage-g73 on 8a42e819, 23:42-23:48Z): tasks 71, bus 81,
business 60, harness 59, cli 113, webui 61, seat 27 node tests, 0 failed;
every scripts/test-*.sh exit 0, 0 failed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/harness/tests/tools.test.mjs

@@ -35,6 +35,14 @@ test("a coder gets no launch, no resolve_decision, and no task tools without a t
   assert.ok(!untyped.includes("message.send"));
 });
 
+test("a coder with a tracker gets its own task tools and no task_reassign", (t) => {
+  const coder = resolvedFor(t, "coder");
+  assert.deepEqual(names(typedTools({ resolved: coder, tracker: true })), [
+    "send_message", "task_scope_change", "task_update_assigned",
+    "raise_decision", "list_agents", "inbox", "trail", "list_tasks",
+  ]);
+});
+
 test("launch only when the business's launch block names the instance as launcher", (t) => {
   const pm = resolvedFor(t, "pm", (d) => delete d.launch);
   assert.equal(pm.launch, null);