feat(tasks): a task can say a session is working it — the claim (milestone 381 step 2)

status is durable and nothing clears it, so in_progress cannot also mean
"someone is on this now". The claim is that second meaning, stored as who
and when so it dies on read rather than needing to be cleared.

- notes.claimed_by / claimed_at / claim_touched_at / claim_session (0110).
- The server stamps it on the write that is the work: reaching in_progress
  (update or create, via apply_status_transition) and a work log on an open
  task. done/cancelled/todo release it. Live while touched within
  CLAIM_LEASE (2h); dead on read past it, with no sweep.
- The plugin's PostToolUse hook on update_task/add_task_log binds the
  harness's session_id (GET /api/plugin/claim-session). It binds only to a
  live claim the caller holds; it cannot create one.
- to_dict carries `claim`. Plugin version minted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/helpers.py

@@ -183,6 +183,9 @@ def fake_note(**attrs) -> MagicMock:
         # Milestone 317: a truthy mock here reads as "this note carries a
         # check", which trips the guard on records that may not have one.
         "verify_with": None, "expires_when": None, "verified_at": None,
+        # Milestone 381: a truthy mock would read as a live claim.
+        "claimed_by": None, "claimed_at": None, "claim_touched_at": None,
+        "claim_session": None,
     }, attrs)
 
 
@@ -193,6 +196,9 @@ def fake_task(**attrs) -> MagicMock:
         "tags": [], "parent_id": None, "project_id": None, "is_task": True,
         "task_kind": "work", "user_id": 7, "deleted_at": None,
         "verify_with": None, "expires_when": None, "verified_at": None,
+        # Milestone 381: a truthy mock would read as a live claim.
+        "claimed_by": None, "claimed_at": None, "claim_touched_at": None,
+        "claim_session": None,
     }, attrs)