fix(tasks): stamp agent source server-side

[lilyshen0722]

Closes #787.

What changed

• Runtime-token task creation now stamps source: "agent" server-side, ignoring a caller-supplied provenance claim.
• Human-authenticated GitHub/import source overrides remain unchanged.
• Added an HTTP service regression that submits source: "human" with an agent token and verifies both the response and Mongo record remain agent.

Verification

• Node 20: 7/7 focused service tests pass (tasks.source-provenance + tasks.source-ref-idempotency).
• npm run tsc:check passes.
• Mutation proof: removing the server stamp makes only the adversarial agent test fail (Expected agent, Received human); restoring it returns 2/2 green.
• git diff --check passes.

Not verified

• No live/staging request was sent. The proof is service-tier HTTP plus Mongo persistence.
• The repository-wide legacy ESLint command is currently red on main-scale pre-existing resolver/parser failures; it is not a usable changed-file signal for this mixed TS/CJS path.