Require revisions for local mutations

[Withphildev]

What changed

• requires expectedRevision on generic card updates, snooze, checklist creation, and checklist updates
• centralizes revision validation so missing or non-integer revisions return 400, while stale revisions return 409 with currentRevision
• updates the agent smoke client to carry each returned card revision into the next mutation
• formalizes dueAt as either YYYY-MM-DD or an offset-bearing ISO instant and rejects ambiguous offset-less date-times
• documents the durable task_events ledger versus the prunable activity_log feed
• upgrades CI to actions/checkout@v7 and actions/setup-node@v6

Why

The foundation exposed optimistic revisions everywhere but four local mutation paths allowed callers to omit them, letting an agent bypass concurrency protection. The audit and date models were also implemented but not explicit enough for clients and reviewers.

Impact

The existing web UI already sends current revisions on all affected paths, so normal board behavior is unchanged. Custom callers that omitted expectedRevision now receive an actionable 400 and must reload before mutating. Rejected mutations do not create audit events.

Validation

• npm --workspace web run lint
• npm test — 25 server tests and 13 web tests passed
• npm run build — server and web production builds passed
• isolated npm run agent:smoke passed
• git diff --check passed
• deletion regression verifies checklist cascade, durable task events, and prunable activity behavior