feat: add task supersede to rescue dependents of dead upstream tasks

[zhangweijian97]

What Changed

• Add task supersede OLD_ISSUE NEW_ISSUE: repoint every same-plan dependent of a dead task (rejected / failed_infra / retired) onto a live replacement task.
• The command rewrites each dependent's dependency list onto the replacement, re-establishes the plan's trusted approvals, and leaves a status comment on the affected Issues explaining the change.
• Guard rails: refuses supersede across plans, refuses terminal replacements, refuses rewrites that would introduce a dependency cycle (validated against the recomputed plan id), and requires the current GitHub login to be a trusted publisher.
• README documents the rejection-recovery use case next to task retire.

Why

When a task ends in a terminal non-done phase, every task whose spec.dependencies references its id waits forever: dependencyBase() only releases a dependent on a verified merge. Today recovery means manually closing and republishing the entire dependent subtree, losing approvals and history. This keeps recovery an explicit operator action but makes it one command instead of a manual subtree republish — especially for agent operators that watch the board programmatically.

How to Test

• bun run typecheck and bun run lint pass.
• bun run test: 332 tests pass including new cases for the successful rewrite + re-approval, and the three refusals (cross-plan, terminal replacement, dependency cycle).
• Note: 3 heavy integration tests time out at the 5s limit on this (slow, loaded) machine also on unmodified main — environment timeouts, not regressions; CI's faster runners should confirm.