Require complete Taskboard thread bindings

[y-ncao]

Summary

• distinguish controller attribution from a complete task thread binding
• require all five binding identity fields when an Agent claims or continues work
• document the existing taskctl binding flags and add a targeted regression test

Root cause

The manage-taskboard skill told Agents to rely on CODEX_THREAD_ID. taskctl correctly used that only as mutation attribution, so status writes omitted threadBinding and became legacy local bindings. Auto Claim then blocked the issue because project and host identity could not be verified.

Verification

• node --test test/manage-taskboard-skill.test.mjs test/cli.test.mjs
• npm test: 451/452 Node tests passed on the first full run; the single injection fixture timeout passed when rerun independently
• git diff --check