feat(tasks): background TaskRunner executor + expanded task states

[Patel230]

Closes the last gap from the KiroCrew line-by-line comparison: hawk's TaskStore was store-only — it had persistence, retry budgets (MarkFailed), replan (Requeue), and checkpoint APIs, but nothing executed tasks. KiroCrew's TaskRunner/TaskExecutor actually run tasks in a loop with retry, recovery, and a watchdog.

What this adds

1. TaskRunner background executor (internal/tool/task_executor.go)

• Picks up ready work (pending tasks with no open blockers) via GetReadyWork().
• Runs each task through a host Execute callback (with optional per-task timeout).
• On failure applies the store's retry budget (MarkFailed) with exponential backoff (retryBackoffTick respected via dueTasks).
• Tasks that exhaust their budget are replanned via OnReplan + Requeue (fresh budget), bounded by MaxReplans per task.
• Watchdog: MaxTotalTasks caps distinct tasks reaching a terminal state (default 50) so a runaway graph can't loop forever.
• Cancellation: Stop()/ctx-done cancels in-flight executions and parks tasks as cancelled (not consuming retry budget).
• Quiesces correctly even when a dependent is permanently blocked behind a failed/skipped/cancelled blocker (no infinite spin).
• Run (blocking) / Start / Stop / Wait / Status.

2. Expanded task states (KiroCrew parity)

• New statuses: reviewing, skipped, cancelled.
• TaskStore.Skip / TaskStore.Cancel (reasons recorded in metadata).
• Schedule() validation extended to accept the new states.
• TaskUpdateTool accepts the new states and resets the retry budget on any explicit exit from failed (not just pending).

3. Live wiring

• ToolContext.TaskExecutor arms the new TaskRunTool: the agent can invoke TaskRun to drive all ready tasks through the executor and get a run summary.
• The session arms it with an agent-spawn based executor: each stored task's subject/description/checkpoint become a general sub-agent's prompt.

Verification

• go build ./..., go vet, golangci-lint, boundary scripts — clean.
• go test ./internal/tool/... ./internal/engine/ ./cmd/ — green.
• New tests cover: completion, dependency ordering, retry-within-budget, park-after-budget, replan, watchdog, stop-cancellation, quiescence-behind-failed-blocker, progress events, Skip/Cancel, TaskRunTool (executes / requires-executor / cancels-on-ctx-timeout).

Stacked on #181 (base feat/security-hygiene-cli).