feat(tasks): adopt Vikunja as task authority with one-way export

把任务的协调状态迁到自建 Vikunja 的 cmbuyer 项目，git 保留单向投影，
并把「活跃任务写路径不得重叠」从自然语言规则变成机器门禁。

- scripts/vikunja_export.py：单向导出（只发 GET），stdlib-only 的
  HTML→Markdown，只覆盖标记区块内，幂等，含 --selftest
- scripts/vikunja-mcp.sh：MCP 启动包装从家目录迁入仓库，版本写死 1.1.1
- scripts/validate_agent_context.py：新增四项离线检查——DOING 任务写路径
  互斥、通配不得圈走共享文档、导出区块 sha256、连接键一致性
- docs/agent-context.json：新增 shared_documents 与 tracker，schema_version 2
- vikunja.env 比照 gitea.env 加入 gitignore，提交 vikunja.env.example

write_paths、## 边界与安全边界条目的权威留在 git，不迁往 Vikunja：
安全边界能否收紧靠 git diff 逐条复核，权威搬到远端会切断审计链。

门禁上线即报出存量违规：T-005 与 T-006 同为 DOING，在 06-tasks.md、
08-interaction-checklist.md、routes.md、current-state.md 四处重叠。
按 T-008 规定不得绕过，须由两者所有者收窄写路径或人工确认后转 DONE。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/agent-context.schema.json

@@ -11,6 +11,8 @@
     "bootstrap",
     "routes",
     "tasks",
+    "shared_documents",
+    "tracker",
     "refresh",
     "degraded_mode"
   ],
@@ -19,7 +21,7 @@
       "const": "docs/agent-context.schema.json"
     },
     "schema_version": {
-      "const": 1
+      "const": 2
     },
     "authority": {
       "type": "object",
@@ -67,6 +69,29 @@
         "template": {"$ref": "#/$defs/repositoryPath"}
       }
     },
+    "shared_documents": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {"$ref": "#/$defs/repositoryPath"}
+    },
+    "tracker": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "project", "export_script", "direction", "git_native_fields"],
+      "properties": {
+        "kind": {"const": "vikunja"},
+        "project": {"type": "string", "minLength": 1},
+        "export_script": {"$ref": "#/$defs/repositoryPath"},
+        "direction": {"const": "tracker_to_git"},
+        "git_native_fields": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "minLength": 1}
+        }
+      }
+    },
     "refresh": {
       "type": "object",
       "additionalProperties": false,