[F128] require active claim on explicit-task content posts

_verify_explicit_task_ownership checked assigned_to, which is stale
across a reap/handoff (persists until reassignment; active_claimant_id is
cleared on release). A reaped agent could keep posting say/dm/note to its
former task. Add the active-claimant check when assigned_to == caller;
assigned_to=None keep its existing allow (read-side inspection between
reassignments uses evidence, which has its own ownership path).

Existing 'active owner' test mocks passed assigned_to=agent_id without
active_claimant_id; production sets both together on claim, so the mocks
were incomplete. Updated to set both — realistic, not a behavior change.

tests/unit/gateway/test_dm_a2a_denied.py

@@ -44,7 +44,12 @@ async def test_dm_a2a_denied_returns_envelope_not_authorized() -> None:
     """A2AAccessDeniedError is caught and returned as Envelope.not_authorized."""
     agent_id = uuid4()
     task_id = uuid4()
-    task_obj = MagicMock(id=task_id, status="in_progress", assigned_to=agent_id)
+    task_obj = MagicMock(
+        id=task_id,
+        status="in_progress",
+        assigned_to=agent_id,
+        active_claimant_id=agent_id,
+    )
 
     task_svc = AsyncMock()
     task_svc.agent_for.return_value = MagicMock(role="qa")