[31/36] Add OC-150 runtime assertion variable task

[cjohnsto-nz]

Stack PR 31/36. This is the docs-only supervisor handoff that defines OC-150; runtime/editor implementation is intentionally owned by the immediate child PR #67.

This branch adds and indexes:

• tasks/15-runtime-assertion-variables.md;
• the OC-150 goal prompt;
• task-board and dependency-map entries;
• acceptance criteria and the focused verification matrix.

The task explicitly requires assertion values to be interpolated as runtime data, deterministic unresolved-variable diagnostics, protocol-neutral HTTP/GraphQL/WebSocket/gRPC behavior, stable WebSocket layout, and reuse of the existing variable-aware authoring path. It also states that arbitrary JavaScript source must not use raw script interpolation semantics, consistent with the PR #65 security correction.

No product code belongs in this planning branch. PR #67 carries the implementation and verification evidence.

Stack integrity:

• updated PR [30/36] Fix runtime script variable evaluation #65 -> PR [31/36] Add OC-150 runtime assertion variable task #66: MERGEABLE/CLEAN;
• PR [31/36] Add OC-150 runtime assertion variable task #66 -> PR [32/36] Add OC-150 runtime assertion variables UX #67: MERGEABLE/CLEAN;
• local merge-tree checks for both edges pass;
• build and both security checks pass.

[APKiwi]

Verdict: approve. Wired consistently into every index (progress table, dependency map, README, goal prompts) and the acceptance criterion's "detected before execution or reported through deterministic assertion diagnostics" wording correctly anticipates the deferred-to-runtime approach the implementation actually took. The suggested-tests table maps cleanly onto the tests that landed.

[cjohnsto-nz]

Confirmed. No code change is required on this branch.

PR #66 is deliberately the OC-150 task-definition and handoff branch. It adds the task page, goal prompt, task-board/dependency entries, acceptance criteria, and test matrix; the immediate child PR #67 owns the editor/runtime implementation. The task's requirement to resolve assertion templates as data—and its explicit warning against raw JavaScript source interpolation—also aligns with the security correction now landed on PR #65.

I rechecked the live stack after updating PR #65: PR #65 -> PR #66 and PR #66 -> PR #67 are both MERGEABLE/CLEAN, and all existing build/security checks pass. The planning branch therefore remains unchanged.