feat(roles): coder drops the task.reassign grant the broker always refuses (#1567, row 73)

roles/coder.json crossRole goes from ["task.reassign", "task.scope.change"]
to ["task.scope.change"]. The broker refuses a non-pm task.reassign at the
writer check before it looks at authority, so the grant could never be
used. A coder's task.reassign now classifies as gated and goes to the
human. Backed by lead decision 90.

Tests: business role and resolve (the narrowing test moves to the pm,
which still holds two cross-role actions), a bus test on the shipped role
files, a harness test that a coder with a tracker gets no task_reassign,
the tasks fixture, and a verbs line showing a coder's task.reassign
refuses field-writer with no action.allowed. mutants.sh is Rocko's packet
rerun script, already committed.

Author: Rocko (packet agents/rocko/work/queue-73/, commit 2137dd7f).
Candidate manifest sha256 bf4e5ed6, base 324c064b, no drift on the
candidate paths through 8a42e819.
Approval: Dewey, round 1, comment 27506 on #1567.
Gate (Sage, /tmp/sage-g73 on 8a42e819, 23:42-23:48Z): tasks 71, bus 81,
business 60, harness 59, cli 113, webui 61, seat 27 node tests, 0 failed;
every scripts/test-*.sh exit 0, 0 failed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/tasks/tests/verbs.test.mjs

@@ -93,6 +93,9 @@ test('assign and reassign move the role bots and record task.assigned', async (t
   // The field-writer check runs before authority, so the refused call consumes nothing.
   await assert.rejects(w.call(coder, 'task.assign', { task_ref, role: 'coder' }), refusedWith('field-writer'));
   assert.equal(allowed(w, 'task.assign').length, 0);
+  // Assignee stays pm-only (decision 90); the coder role holds no task.reassign grant, and the verb refuses it anyway.
+  await assert.rejects(w.call(coder, 'task.reassign', { task_ref, role: 'reviewer' }), refusedWith('field-writer'));
+  assert.equal(allowed(w, 'task.reassign').length, 0);
   await assert.rejects(w.call(pm, 'task.assign', { task_ref, role: 'cto' }), refusedWith('unknown-role'));
   await assert.rejects(w.call(pm, 'task.assign', { task_ref, role: 'toString' }), refusedWith('unknown-role'));
   await assert.rejects(w.call(pm, 'task.reassign', { task_ref, role: 'coder' }), refusedWith('task-unassigned'));

packages/tasks/tests/world.mjs

@@ -42,7 +42,7 @@ export const AUTHORITY = {
   },
   coder: {
     withinRole: ['task.update.assigned', 'git.push.working', 'review.request', 'message.send'],
-    crossRole: ['task.reassign', 'task.scope.change'],
+    crossRole: ['task.scope.change'],
   },
   reviewer: { withinRole: ['review.verdict', 'message.send', 'task.update.assigned'], crossRole: [] },
   cto: {