feat(task): mission/task schemas, validation, and run runner (#6) (#7)

- scripts/mosaic-task.mjs: validate | run | list
- Strict v1 schemas: unknown keys rejected; ids/prompt/expectExact/
  timeoutSeconds bounds enforced; optional mission file resolved against
  the task file and validated too
- run: executes through the config-driven container path with stdin
  detached (issue #5 class), SIGKILL timeout (default 120s), trimmed
  response capture
- Immutable run records under <dataRoot>/runs/r-<utcstamp>-<rand>/:
  task.json + mission.json snapshots (write-once), stderr.txt, result.json
- expectExact gate: mismatch -> status failed, exit 1; result.json is
  always written
- scripts/run-task.sh: load_config + bootstrap_runtime_dir before exec
- M2 scope: mission directives are snapshotted for provenance, not yet
  injected into the runtime prompt (later policy layer)

Closes #6, closes #7

scripts/run-task.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Run a mission/task file through the config-driven container path.
+#
+# Usage: scripts/run-task.sh run <task.json>   (also: validate <task.json>, list)
+#
+# Ensures the configuration is valid and the data root carries the
+# ownership marker before any task executes.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+# shellcheck source=common.sh
+source scripts/common.sh
+
+load_config
+bootstrap_runtime_dir
+
+exec node scripts/mosaic-task.mjs "$@"