Agent-task read surfaces are not gated behind repo/task visibility rules

Task read endpoints (GET /tasks, GraphQL subscriptions) serve task data without checking repo visibility or task-level access rules. This allows unauthenticated callers to read task bodies on private repos.

Needed:

Gate task reads behind authorize_repo_read
Decouple open-claim eligibility from read visibility
Apply rate limiting to GraphQL WebSocket subscriptions
Enforce hostile-node response limits in the CLI and MCP client

Address review feedback on quarantined task claims, WebSocket auth, a…

Reject forged signatures during WebSocket authentication upgrade.

Accumulate forged WebSocket handshake response until headers terminate.

Withhold quarantined-repo tasks on all read surfaces before party che…

docs: Align task-read documentation with enforced visibility and rate…

docs: Distinguish task list and get behavior in rate-limit guidance.

fix(node): Batch task quarantine checks to bound read costs.

docs(node): clarify the shared task-read budget

Address review feedback on task-read authorization gating, WebSocket …