Add generic cloud-safe execution task contracts

[mark-e-deyoung]

Adds three target-agnostic Agent Dispatch task contracts for real repository work without expanding the dispatcher runtime:

• qualify-exact-head — exact-SHA deterministic qualification with stale-head fail-closed behavior;
• advance-cloud-safe-work — one bounded hosted increment within repository-native authority;
• reduce-experiment-evidence — sparse decision-changing evidence reduction.

The existing reconcile-repository-state task remains the fourth reusable class; no duplicate task was added.

Why this shape:

• reuses the existing approved task registry and secret-backed target mapping;
• does not revive the stale/conflicted private-contract loader or create target-side transport records;
• does not add queues, schedulers, databases, routing, new secrets, or provider APIs;
• leaves each target repository's issue/PR/workset as durable authority;
• preserves merge/release/secret/paid-resource/native-acceptance boundaries.

This is preparatory control-plane work only. It does not activate any new target mapping and does not claim native-Windows acceptance.