feat(tasks): add needs_human intervention flag (CUST-WP-0009)

- Migration b4c5d6e7f8a9: adds needs_human (bool) + intervention_note (text) to tasks
- API: needs_human filter on GET /tasks/; 422 if flagged without note
- 3 MCP tools: flag_for_human, clear_human_flag, list_human_interventions
- Dashboard: interventions.md with amber cards and "Mark done" button
- Policy router + workstream DoD policy (workstream-dod.md)
- Workstream lifecycle docs page + workplan CUST-WP-0010
- CLAUDE.md: add step 4 (run fix-consistency after workplan writes)
- consistency_check.py: promote C-11 unlinked tasks from INFO to WARN

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/policy.py

@@ -0,0 +1,41 @@
+import re
+from pathlib import Path
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+
+POLICY_DIR = Path(__file__).parent.parent.parent / "policies"
+_VALID_NAME = re.compile(r"^[a-z0-9][a-z0-9-]{0,63}$")
+
+router = APIRouter(prefix="/policy", tags=["policy"])
+
+
+class PolicyRead(BaseModel):
+    name: str
+    content: str
+
+
+class PolicyUpdate(BaseModel):
+    content: str
+
+
+def _policy_path(name: str) -> Path:
+    if not _VALID_NAME.match(name):
+        raise HTTPException(status_code=400, detail="Invalid policy name")
+    path = POLICY_DIR / f"{name}.md"
+    if not path.exists():
+        raise HTTPException(status_code=404, detail=f"Policy '{name}' not found")
+    return path
+
+
+@router.get("/{name}", response_model=PolicyRead)
+def get_policy(name: str) -> PolicyRead:
+    path = _policy_path(name)
+    return PolicyRead(name=name, content=path.read_text())
+
+
+@router.put("/{name}", response_model=PolicyRead)
+def update_policy(name: str, body: PolicyUpdate) -> PolicyRead:
+    path = _policy_path(name)
+    path.write_text(body.content)
+    return PolicyRead(name=name, content=body.content)

api/routers/tasks.py

@@ -1,6 +1,6 @@
 import uuid
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -16,6 +16,7 @@ async def list_tasks(
     workstream_id: uuid.UUID | None = None,
     status: TaskStatus | None = None,
     assignee: str | None = None,
+    needs_human: bool | None = Query(None),
     session: AsyncSession = Depends(get_session),
 ) -> list[Task]:
     q = select(Task)
@@ -25,6 +26,8 @@ async def list_tasks(
         q = q.where(Task.status == status)
     if assignee:
         q = q.where(Task.assignee == assignee)
+    if needs_human is not None:
+        q = q.where(Task.needs_human == needs_human)
     q = q.order_by(Task.created_at)
     result = await session.execute(q)
     return list(result.scalars().all())