feat: add provider-neutral task-to-PR projection

[andrei-hasna]

Summary

• add a strict provider-neutral hasna.task_to_pr_projection.v1 contract with frozen authority/cardinality, deterministic canonical binding, and cumulative identity-only provenance
• enforce replay, attempt/generation/WorkRun, recovery/handoff/cancellation, repair-cap, exact-head/review/proof, merge CAS/outcome, cleanup, rollback, and local/cloud equivalence invariants
• preserve legacy v1 contracts and WorkRun behavior, update the source package version to 0.6.0, and add a conforming example plus regression-first coverage

Validation

• bun run verify:release: 256 passed, 7 pre-existing live-Postgres skips, 0 failed, 1426 assertions
• focused projection suite: 38 passed, 512 assertions
• typecheck, example conformance, declaration build, dist smoke, pack dry run, staged/range secret scans, and two exact-hash adversarial reviews passed

No package publish, merge, release, or deployment is included.