fix(gateway): working exits for wedged agents + declare_coverage roll-up unblock (#341)

A live task burned 5+ hours because every exit was locked. unclaim now
works from verifying and needs_revision (service guard + lifecycle edge);
the circuit breaker and the i_am_done push-failure remediate name the
working chain ending in unclaim(); sync_branch(stash=true) clears the
DIRTY_WORKSPACE dead-end (pop-conflict preserves the stash); blocking a
task QA already owns now says to idle instead of listing states; the
orchestrator auto-block logs real errors and skips states where blocking
is meaningless instead of force-blocking them.

declare_coverage (cell/main PM) retroactively stamps parent-AC refs on a
child that implements them -- closing the roll-up deadlock where the
declaring child was cancelled and its re-delegated replacement completed
the work uncredited. Cancelling a ref-declaring child now warns and
surfaces the orphaned criteria.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/services/test_task.py

@@ -1094,6 +1094,18 @@ async def test_uncovered_parent_acs_recognizes_text_declared_coverage() -> None:
     assert await svc.uncovered_parent_acceptance_criteria(parent.id) == []
 
 
+def test_unknown_ac_refs_flags_refs_not_on_parent() -> None:
+    # declare_coverage's validation primitive: accepts a parent criterion by
+    # id OR exact text; anything else is unknown and must be rejected with
+    # the parent's real AC list in the remediate.
+    parent = _build_task(
+        acceptance_criteria=["crit a", "crit b"],
+        acceptance_criteria_ids=["id-a", "id-b"],
+    )
+    assert TaskService.unknown_ac_refs(parent, ["id-a", "crit b", "bogus"]) == ["bogus"]
+    assert TaskService.unknown_ac_refs(parent, ["id-a", "crit b"]) == []
+
+
 @pytest.mark.asyncio
 async def test_parent_ac_coverage_normalizes_text_refs() -> None:
     # A text-declared coverage ref from a COMPLETED child surfaces as