feat(tasks): adopt Vikunja as task authority with one-way export

把任务的协调状态迁到自建 Vikunja 的 cmbuyer 项目，git 保留单向投影，
并把「活跃任务写路径不得重叠」从自然语言规则变成机器门禁。

- scripts/vikunja_export.py：单向导出（只发 GET），stdlib-only 的
  HTML→Markdown，只覆盖标记区块内，幂等，含 --selftest
- scripts/vikunja-mcp.sh：MCP 启动包装从家目录迁入仓库，版本写死 1.1.1
- scripts/validate_agent_context.py：新增四项离线检查——DOING 任务写路径
  互斥、通配不得圈走共享文档、导出区块 sha256、连接键一致性
- docs/agent-context.json：新增 shared_documents 与 tracker，schema_version 2
- vikunja.env 比照 gitea.env 加入 gitignore，提交 vikunja.env.example

write_paths、## 边界与安全边界条目的权威留在 git，不迁往 Vikunja：
安全边界能否收紧靠 git diff 逐条复核，权威搬到远端会切断审计链。

门禁上线即报出存量违规：T-005 与 T-006 同为 DOING，在 06-tasks.md、
08-interaction-checklist.md、routes.md、current-state.md 四处重叠。
按 T-008 规定不得绕过，须由两者所有者收窄写路径或人工确认后转 DONE。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/agent-context.json

@@ -1,6 +1,6 @@
 {
   "schema": "docs/agent-context.schema.json",
-  "schema_version": 1,
+  "schema_version": 2,
   "authority": {
     "bootstrap": "local_checkout",
     "framework_templates": "current_repository",
@@ -57,6 +57,34 @@
     "directory": "docs/tasks/",
     "template": "docs/tasks/_template.md"
   },
+  "shared_documents": [
+    "AGENTS.md",
+    "README.md",
+    "docs/00-ai-start-here.md",
+    "docs/02-requirements.md",
+    "docs/03-tech-stack.md",
+    "docs/04-architecture.md",
+    "docs/05-coding-rules.md",
+    "docs/06-tasks.md",
+    "docs/07-user-stories.md",
+    "docs/08-interaction-checklist.md",
+    "docs/api.md",
+    "docs/current-state.md",
+    "docs/routes.md",
+    "docs/tasks/README.md"
+  ],
+  "tracker": {
+    "kind": "vikunja",
+    "project": "cmbuyer",
+    "export_script": "scripts/vikunja_export.py",
+    "direction": "tracker_to_git",
+    "git_native_fields": [
+      "write_paths",
+      "context_ref",
+      "work_branch",
+      "boundaries_section"
+    ]
+  },
   "refresh": {
     "context_ref": "default_branch_head_sha",
     "cache_key": "file_sha",