[Chore] Guard review notification identity and target boundaries

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

Regression coverage for #2281. No separate issue.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

Add tests around linked review notification identity and target boundaries. The runtime fix already landed in #2281: send/steer handlers resolve the current run actor or durable task owner instead of rejecting a userless mint-time token. This PR is tests-only and does not change task access, impersonate a user, or duplicate that fix.

• Reject linked handoffs with no token, missing/non-review source runs, missing PR metadata or owner, and unrelated target tasks before delivery, resume, activity updates, or actor changes.
• Verify both send and steer use the live acting user rather than stale token attribution.
• Extend missing-identity rejection coverage to steering as well as sending.

The benefit is regression protection, not a new production behavior. Existing structural handoff failures still return 500; this PR deliberately does not redesign their status codes or ordinary task-message authorization.

How it was tested

• Temporarily reinstated the pre-[Fix] Review handoffs fail with 403 User context required #2281 token-only checks: three authorized userless-token cases reproduced 403, and both stale-actor cases used the wrong user (five failures total). Restored the runtime files exactly before final validation.
• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/api exec vitest run src/handlers/tasks/__tests__/sendMessageUserContext.test.ts src/handlers/tasks/__tests__/sendMessageToTask.test.ts src/handlers/tasks/__tests__/fastSessionTaskCommunication.test.ts src/handlers/tasks/__tests__/acting-user-sync.test.ts src/__tests__/route-policy-enforcement.test.ts: 94 tests passed in five suites, including existing resume and actor-preservation coverage.
• pnpm --filter @roomote/api check-types and git diff --check passed. Normal pre-commit and pre-push gates passed, including oxlint, residual ESLint, all 27 fast typecheck tasks, and Knip (existing non-failing Mint configuration hint).
• These are mocked handler/orchestration checks, not a live tenant-isolation or deployed end-to-end replay. No production task was resumed or sent a test message. Browser proof is not applicable to tests-only, nonvisual behavior.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally (focused API tsc and normal repository push gates passed; full commands not run)
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset (not applicable: tests only)

[roomote-community]

No code issues found. See task

_{Reviewed 69f272d}