TCC-S04: Make task check the full local gate with named exclusions #175

Severity: Low (naming/consistency) · Epic: TCC · Landing order: 9 of 21 · Blocked by: none

task check must be the full local gate: everything CI requires that can run locally, with exclusions (network/infra-gated such as e2e, push-only evidence) named in its desc. No task verify as a fast subset (verify stays reserved for generated-artifact drift, if ever needed).

Spec: openspec/specs/p5-tcc-toolchain-consistency/spec.md — TCC-S04, REQs REQ-TCC-S04-01, REQ-TCC-S04-02; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Acceptance (one PR; TDD — failing test first):

• REQ-TCC-S04-01 — task check desc names its exclusions and no verify fast-subset alias exists — bash hack/lint/task_entrypoints_test.sh
• REQ-TCC-S04-02 (adversarial) — a verify: task whose body is a subset of check is red — bash hack/lint/task_entrypoints_test.sh --self-test

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).