fix(agent): Chat Agent 全链路 P0-P5 整改

封堵鉴权旁路与导出 IDOR，DocGov 改服务端身份；对话层 PendingAction 接真实 docgov/taskrun；修复流式租约假死与会话级任务流；加固配置/doc_id/NULL；补齐 slog 与测试；前端 ErrorBoundary 与受控文档重试。

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/api/taskStream.ts

@@ -1,4 +1,5 @@
 import { parseSSEChunk, type StreamEvent } from './chatStream';
+import { canonicalDocIdForTask } from '../lib/controlledDocHydrate';
 import type { TaskRunContext } from '../types/workbench';
 
 export type { TaskRunContext };
@@ -63,7 +64,13 @@ export function buildTaskRequest(task: TaskRunContext): Record<string, unknown>
   if (task.materials && task.materials.length > 0) {
     body.materials = task.materials;
   }
-  if (task.docId) body.doc_id = task.docId;
+  const canonicalDocId = canonicalDocIdForTask(
+    task.projectId,
+    task.taskKey,
+    undefined,
+    task.docId,
+  );
+  if (canonicalDocId) body.doc_id = canonicalDocId;
   return body;
 }