feat: phases + tasks — per-task execution with phase directories

- A phase is now a directory: 00_phase.md (overview + task index) plus
  small, quick NN_task.md task files; complete/ mirrors todo/
- Task is the unit of execution: run-task.sh (one unit), run-phase.sh
  (phase to completion incl. 00_phase.md final pass), auto-phase.sh
  (all units in order); validate.sh gate runs after every task
- PHASE_COMMIT commits at phase boundaries (00_phase.md / legacy file moves)
- Legacy flat todo/NN_name.md files still execute as a single unit;
  new migrate-phases-to-tasks.sh converts them to the directory layout
- phase-status.sh reports per-task state and the next unit
- New task-template.md; phase templates now carry a Tasks index

phased-execution/scripts/run-task.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# run-task.sh — execute exactly one task in a fresh pi context.
+#
+# A task is the smallest execution unit: a task file inside a phase
+# directory (03_api/02_routes.md), a phase's 00_phase.md final pass, or a
+# legacy single-file phase.
+#
+# Usage:
+#   run-task.sh                     # next pending task (pipeline order)
+#   run-task.sh 03_api/02_routes.md # a specific task (warns if out of order)
+#   run-task.sh 03_api/02_routes    # ".md" is added when missing
+#
+# Env: see SKILL.md (MAX_FIX_ATTEMPTS, PHASE_MODEL, PHASE_THINKING,
+#      PHASE_COMMIT, PI_TRUST, FRESH_FIX).
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/lib.sh"
+
+# Make interruptions visible: state stays in .agent/phases/todo, and the
+# failed executor's session is still resumable on the next run.
+trap 'echo; echo "✗ ERROR: interrupted (SIGINT) — ${unit:-this task} is left in $PHASE_TODO/; re-run to continue" >&2; exit 130' INT
+trap 'echo; echo "✗ ERROR: interrupted (SIGTERM) — ${unit:-this task} is left in $PHASE_TODO/; re-run to continue" >&2; exit 143' TERM
+
+cd "$(find_root)" || die "no .agent/phases/todo found in this or parent directories (run /to-phase or /audit-create first)"
+
+unit="${1:-}"
+if [[ -n "$unit" ]]; then
+  [[ "$unit" == *.md ]] || unit="$unit.md"
+  [[ -f "$PHASE_TODO/$unit" ]] || die "$unit not found in $PHASE_TODO/"
+  first="$(next_unit)"
+  if [[ -n "$first" && "$first" != "$unit" ]]; then
+    warn "execution order: $first is pending before $unit — running out of order"
+  fi
+else
+  unit="$(next_unit)"
+  [[ -n "$unit" ]] || { echo "✓ no pending tasks in $PHASE_TODO/ — project complete."; exit 0; }
+fi
+
+build_pi_args
+if execute_unit "$unit"; then
+  exit 0
+fi
+echo "✗ ERROR: task $unit FAILED after $MAX_FIX_ATTEMPTS attempts" >&2
+echo "  reports: $(unit_report_dir "$unit")/$(unit_base "$unit").a*.{md,err,validate}" >&2
+echo "  resume:  re-run this script — the failed executor session is resumed automatically" >&2
+exit 1