Retain trusted input bindings for task result reuse

Why: Completed tasks require current source authorization and content validation.

Evidence: Optional fields preserve existing contracts; composition verification follows.

Impact: Adds host-owned input source references with no new model authority.

Refs: fast-slow-u2-u3 Tasks 2 and 4

task_snapshot.go

@@ -74,6 +74,7 @@ type TaskSnapshot struct {
 	NextStep               string            `json:"nextStep,omitempty"`
 	Conclusion             string            `json:"conclusion,omitempty"`
 	Findings               []TaskFinding     `json:"findings,omitempty"`
+	Inputs                 []TaskSourceRef   `json:"inputs,omitempty"`
 	Actions                []UIAction        `json:"actions,omitempty"`
 	ResultRefs             []TaskResultRef   `json:"resultRefs,omitempty"`
 	LastActivityAt         time.Time         `json:"lastActivityAt,omitempty"`

ts/types.ts

@@ -406,6 +406,7 @@ export interface TaskSourceRef { id: string; artifactId: ID; contentHash: string
 export interface TaskResultRef { artifactId?: ID; surfaceId?: ID; version?: string; contentHash?: string; availability: string; name?: string }
 export interface TaskFinding { id: string; text: string; impact?: string; kind: string; status: string; revision: number; sources: TaskSourceRef[]; assumptions?: string; corrects?: string }
 export interface TaskSnapshot {
+	inputs?: TaskSourceRef[]
  schemaVersion: number; taskId: ID; attemptId: ID; cardId: ID; projectId: ID; conversationId: ID;
  sourceMessageId?: ID; parentRunId?: ID; runId?: ID; ownerInstanceId: string; executionEpoch?: number;
  revision: number; sourceSeq: number; streamScope: string; inputRevision?: string; title: string; goal?: string;