Merge current main into versioned dependency workspace

Why: Include the latest Dev task-card closure and governance fix while preserving the versioned dependency migration.
Evidence: SELF merge conflict inspection, clean staged diff, bash syntax check, and prior isolated E2E replay; full final-head verification pending.
Impact: Keep existing Backend and Frontend source directories outside the Git index and retain their on-disk Git data. Preserve password setup, audit grants, scoped browser coverage, and owned process cleanup.
Refs: #537, #538, mq-dev-20261014-537-01

scripts/task.sh

@@ -64,7 +64,9 @@ cmd_precheck() {
     pb=$(card_of_branch "$pc"); [ -n "$pb" ] || continue
     pst=$(card_status "$pc"); case "$pst" in 已完成*) continue ;; esac
     card_pending "${pc##*/}" && continue
-    if git log --merges --format='%s' "origin/${TARGET_BRANCH}" 2>/dev/null | grep -qF " from $pb into ${TARGET_BRANCH}"; then
+    # Consume the complete producer output: grep -q exits on the first match,
+    # making git log die with SIGPIPE (141 under pipefail) on long histories.
+    if git log --merges --format='%s' "origin/${TARGET_BRANCH}" 2>/dev/null | grep -F " from $pb into ${TARGET_BRANCH}" >/dev/null; then
       open_cards="${open_cards} ${pc##*/}"
     fi
   done
@@ -392,7 +394,7 @@ card_of_branch() { sed -n 's/^- 工作区：.*分支：\([A-Za-z0-9._/-]\+\).*/\
 card_status() { sed -n 's/^.*；状态：\([^；]*\).*/\1/p' "$1" | head -1; }
 card_merge() { # $1=branch → "sha|subject"（该分支合入 origin/<target> 的合并提交）
   git log --merges --format='%H|%s' "origin/${TARGET_BRANCH}" 2>/dev/null \
-    | grep -F " from $1 into ${TARGET_BRANCH}" | head -1
+    | grep -F " from $1 into ${TARGET_BRANCH}" | sed -n '1p'
 }
 card_pending() { # $1=卡片文件名——闭合是否已在某 origin/feature/card-close-* 分支待合入
   local cb