feat(tasks): add needs_human intervention flag (CUST-WP-0009)

- Migration b4c5d6e7f8a9: adds needs_human (bool) + intervention_note (text) to tasks
- API: needs_human filter on GET /tasks/; 422 if flagged without note
- 3 MCP tools: flag_for_human, clear_human_flag, list_human_interventions
- Dashboard: interventions.md with amber cards and "Mark done" button
- Policy router + workstream DoD policy (workstream-dod.md)
- Workstream lifecycle docs page + workplan CUST-WP-0010
- CLAUDE.md: add step 4 (run fix-consistency after workplan writes)
- consistency_check.py: promote C-11 unlinked tasks from INFO to WARN

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/schemas/task.py

@@ -1,5 +1,6 @@
 import uuid
 from datetime import date, datetime
+from typing import Self
 
 from pydantic import BaseModel, ConfigDict, model_validator
 
@@ -15,8 +16,16 @@ class TaskCreate(BaseModel):
     assignee: str | None = None
     due_date: date | None = None
     blocking_reason: str | None = None
+    needs_human: bool = False
+    intervention_note: str | None = None
     parent_task_id: uuid.UUID | None = None
 
+    @model_validator(mode="after")
+    def intervention_note_required_when_flagged(self) -> Self:
+        if self.needs_human and not self.intervention_note:
+            raise ValueError("intervention_note is required when needs_human is True")
+        return self
+
 
 class TaskUpdate(BaseModel):
     title: str | None = None
@@ -26,14 +35,22 @@ class TaskUpdate(BaseModel):
     assignee: str | None = None
     due_date: date | None = None
     blocking_reason: str | None = None
+    needs_human: bool | None = None
+    intervention_note: str | None = None
     parent_task_id: uuid.UUID | None = None
 
     @model_validator(mode="after")
-    def blocking_reason_required_when_blocked(self) -> "TaskUpdate":
+    def blocking_reason_required_when_blocked(self) -> Self:
         if self.status == TaskStatus.blocked and not self.blocking_reason:
             raise ValueError("blocking_reason is required when status is blocked")
         return self
 
+    @model_validator(mode="after")
+    def intervention_note_required_when_flagged(self) -> Self:
+        if self.needs_human and not self.intervention_note:
+            raise ValueError("intervention_note is required when needs_human is True")
+        return self
+
 
 class TaskRead(BaseModel):
     model_config = ConfigDict(from_attributes=True)
@@ -46,6 +63,8 @@ class TaskRead(BaseModel):
     assignee: str | None = None
     due_date: date | None = None
     blocking_reason: str | None = None
+    needs_human: bool
+    intervention_note: str | None = None
     parent_task_id: uuid.UUID | None = None
     created_at: datetime
     updated_at: datetime