fix(tasks): import minted_kind by name — a stubbed service must not stub the guard (#3129)

CI 4682: test_create_task_issue_sets_kind_provenance_and_systems asserted
task_kind == "issue" and got a MagicMock. That test patches the whole
notes_svc module to keep the database out, so reaching validation through
`notes_svc.minted_kind(...)` handed back a mock — the guard approved
anything and returned nothing real.

The product was wrong, not the test. minted_kind is pure validation, not a
service call, so it is imported by name. A test that stubs the service to
avoid I/O now keeps the guard intact, which is the behaviour you want from
a guard: the only way to disable it should be to say so explicitly.

That test now exercises the real validation, so it doubles as the guard
against this recurring.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/scribe/mcp/tools/tasks.py

@@ -23,6 +23,11 @@ from scribe.mcp.tools import systems as systems_tools
 from scribe.services import access as access_svc
 from scribe.services import dedup as dedup_svc
 from scribe.services import notes as notes_svc
+# Imported by NAME, not reached through notes_svc: minted_kind is pure
+# validation, not a service call, and a test that stubs the service module to
+# avoid the database would otherwise stub the validation too — turning a
+# guard into a MagicMock that approves anything.
+from scribe.services.notes import minted_kind
 from scribe.services import planning as planning_svc
 from scribe.services import rulebooks as rulebooks_svc
 from scribe.services import systems as systems_svc
@@ -194,7 +199,7 @@ async def create_task(
         milestone_id=milestone_id or None,
         parent_id=parent_id or None,
         tags=tags,
-        task_kind=notes_svc.minted_kind(kind),
+        task_kind=minted_kind(kind),
         arose_from_id=arose_from_id or None,
     )
     if system_ids:
@@ -266,7 +271,7 @@ async def update_task(
     elif arose_from_id:
         fields["arose_from_id"] = arose_from_id
     if kind:
-        fields["task_kind"] = notes_svc.minted_kind(kind)
+        fields["task_kind"] = minted_kind(kind)
     note = await notes_svc.update_note(uid, task_id, **fields)
     if note is None:
         raise ValueError(f"task {task_id} not found")