feat: bug fix wave v1.36.0.0 — Implementation Tasks, allowlist patterns, surrogate-safe page captures (#1440 #1452 #1454)

Three filed issues land together:

#1440 — Page captures from real-world HTML hit 'API Error 400: no low
surrogate in string'. Sanitizers + buildCommandResponse extraction shipped in
the prior commit; this commit adds the migration script that patches existing
brain-allowlist/privacy-map/gitattributes installs and the supporting tests.

#1452 — Federation sync was silently skipping root-level design and test-plan
docs. bin/gstack-artifacts-init adds two patterns to all three managed blocks
(.brain-allowlist, .brain-privacy-map.json, .gitattributes). Idempotent
migration v1.36.0.0.sh repairs existing installs in place via jq (preserves
JSON validity) — no commit + push from the migration.

#1454 — All four review skills (CEO/design/eng/DX) emit an Implementation
Tasks markdown section AND write a jq-built JSONL artifact per phase.
/autoplan reads all four files, scopes by current branch + 5-commit window,
dedupes on exact (component, sorted(files), title), and renders an aggregated
list in the Final Approval Gate.

New tests:
- browse/test/sanitize.test.ts (18 cases)
- browse/test/build-command-response.test.ts (7 cases)
- test/artifacts-init-migration.test.ts (7 cases)

VERSION → 1.36.0.0. Skips the v1.34.x slot taken by 'gstack consumable as
submodule' and the v1.35.0.0 slot taken by /document-generate. #1428 was
shipped separately by v1.34.2.0 with a different approach; follow-up #1503
filed for the bare-path filesystem boundary concern surfaced during our
analysis.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/task-emission-schema.ts

@@ -0,0 +1,61 @@
+/**
+ * Schema reference for the per-skill Implementation Tasks JSONL artifact (#1454).
+ *
+ * Each review skill (plan-ceo-review, plan-design-review, plan-eng-review,
+ * plan-devex-review) writes one JSONL line per task during its synthesis step
+ * to `~/.gstack/projects/$SLUG/tasks-{phase}-{datetime}.jsonl`.
+ *
+ * `/autoplan`'s Phase 4 aggregator reads ALL phase JSONL files, scopes them
+ * by branch + commit window, dedupes by exact (component, sorted(files), title),
+ * and renders an `## Implementation Tasks (aggregated across phases)` section
+ * inside the Final Approval Gate output.
+ *
+ * Wire format: one JSON object per line. Build via `jq -nc` from bash — never
+ * by hand-rolled echo/printf, because task titles and source findings may
+ * contain quotes, newlines, and backslashes.
+ */
+
+export type TaskPhase = 'ceo-review' | 'design-review' | 'eng-review' | 'devex-review';
+export type TaskPriority = 'P1' | 'P2' | 'P3';
+
+/**
+ * One row in tasks-{phase}-{datetime}.jsonl. All fields required unless noted.
+ */
+export interface ImplementationTask {
+  /** Which review phase produced this task. */
+  phase: TaskPhase;
+  /** Unique run identifier for this phase invocation (timestamp + pid suffix). */
+  run_id: string;
+  /** Branch the review ran on. Aggregator filters by this. */
+  branch: string;
+  /** HEAD commit at review time. Aggregator filters by commit-window proximity. */
+  commit: string;
+  /** Short task id, unique within a single run_id (T1, T2, ...). */
+  id: string;
+  priority: TaskPriority;
+  /** Coarse component label (e.g., `browse/sanitizer`, `auth/login`). */
+  component: string;
+  /** Files the task touches. Aggregator sorts this and uses it in the dedup key. */
+  files: string[];
+  /** Human-team effort estimate (e.g., "2h", "1 day"). */
+  effort_human: string;
+  /** CC+gstack effort estimate (e.g., "15min"). */
+  effort_cc: string;
+  /** Action-oriented title in imperative form ("Add commandResult-level sanitization"). */
+  title: string;
+  /** Free-text reference to the finding that motivated this task. */
+  source_finding: string;
+}
+
+/**
+ * Dedup key for the aggregator. Two tasks collapse into one ONLY when this
+ * tuple is identical (per `D13 finding 9`). Near-duplicates surface as
+ * separate tasks with a `possible-duplicate-of: <id>` note.
+ */
+export function dedupKey(t: Pick<ImplementationTask, 'component' | 'files' | 'title'>): string {
+  return JSON.stringify({
+    component: t.component,
+    files: [...t.files].sort(),
+    title: t.title,
+  });
+}