docs(contributor): refresh task board for v0.4.5 and current hardening

[huangruiteng]

Summary

Small docs-only refresh of CONTRIBUTOR_TASKS.md after the v0.4.5 release and the latest control-plane hardening.

• Mark GH-C87 done: the fresh-project /loopx onboarding fix (fix: unblock the first /loopx run on a fresh project #3093) and five-scenario regression fixture (test(control-plane): add fresh-project onboarding regression fixture (#3092) #3103) are merged.
• Bump release-docs slices from v0.4.4 to v0.4.5 (priority queue, maintainer progress, GH-C04).
• Add GH-C90 (security-boundary negative fixtures for fix(status-server): stop sending ACAO:* on unauthenticated read responses #3137-fix(refresh-state): contain --state-file override to the project root #3140) and GH-C91 (obligation-bound replan/evidence-read fixtures for fix: require evidence-read receipts for replan ACK #3112/feat(control-plane): make evidence-log read enforcement hard-only with failure receipt escape #3135/fix(control-plane): bind replan reads by obligation identity #3144).
• Reflect merged milestones: PR-review lenses (feat(pr-review): harden execution contract with four self-dev review lenses #3123) and durable smoke-value evidence (feat(pr-review): require durable smoke value evidence for example-only PRs #3134), replan novelty/evidence-log hardening (feat(control-plane): add replan novelty guidance and evidence-log read policy #3100-test(replan): execute evidence-log behavior through real LoopX #3106, fix: require evidence-read receipts for replan ACK #3112, feat(control-plane): make evidence-log read enforcement hard-only with failure receipt escape #3135, fix(control-plane): bind replan reads by obligation identity #3144), React homepage (feat(site): rebuild homepage in React #3098), goal-artifact lifecycle RFC (docs(rfc): add goal artifact lifecycle projection v0 #3136), and onboarding/docs progress.

No runtime, benchmark, or public first-screen behavior changes.

Validation

• git diff --check clean
• loopx check --scan-path CONTRIBUTOR_TASKS.md: 0 errors, public-boundary scan clean
• python3 examples/docs-governance-smoke.py: ok
• Security boundary tests: 44 passed (test_state_file_containment, test_worker_command_validation, test_feedback_goal_id_validation, test_status_server_cors)
• Replan tests: 24 passed (test_replan_novelty_policy, test_replan_required_read_receipts); test_replan_evidence_tool_behavior hangs in this local worktree (known host-Python loopx issue) and is covered by CI
• quota-replan-decision-plane-smoke: ok
• full-public-smokes-workflow-smoke: ok (inventory=650)

No private state, raw evidence, credentials, or local paths are introduced.