Add spec-aware orch tasks and verification gates

docs/tests/orch/reconcile/README.md

@@ -5,4 +5,5 @@
 | Case Slug | File | Coverage Note |
 | --- | --- | --- |
 | `reconcile-maps-claimed-or-in-progress-thread-to-running` | [reconcile-maps-claimed-or-in-progress-thread-to-running.md](./reconcile-maps-claimed-or-in-progress-thread-to-running.md) | maps worker claim or in-progress inbox state back into a running orch task |
-| `reconcile-maps-done-or-failed-thread-to-terminal-task-state` | [reconcile-maps-done-or-failed-thread-to-terminal-task-state.md](./reconcile-maps-done-or-failed-thread-to-terminal-task-state.md) | maps terminal inbox states into terminal task states and updates run aggregates |
+| `reconcile-maps-done-or-failed-thread-to-terminal-task-state` | [reconcile-maps-done-or-failed-thread-to-terminal-task-state.md](./reconcile-maps-done-or-failed-thread-to-terminal-task-state.md) | maps `done` without a gate or `failed` inbox states into terminal task states and updates run aggregates |
+| `reconcile-maps-done-thread-to-verifying-when-task-has-required-checks` | [reconcile-maps-done-thread-to-verifying-when-task-has-required-checks.md](./reconcile-maps-done-thread-to-verifying-when-task-has-required-checks.md) | routes worker `done` into `verifying` when the task has required checks |

docs/tests/orch/reconcile/reconcile-maps-done-or-failed-thread-to-terminal-task-state.md

@@ -3,10 +3,15 @@
 ## 用例意义
 
 验证 `reconcile` 会把 worker 侧 thread 的终态同步到 `orch` 任务，并刷新 run 聚合状态。
+这个 case 只覆盖两类终态：
+
+- worker `done` 且 task 没有 required checks
+- worker `fail`
 
 ## 前置条件
 
 - 已存在 run 和已 dispatch 的任务
+- 该任务没有 configured verification gate，或者输入使用的是 `fail`
 - worker 已对该 thread 完成 `done` 或 `fail`
 
 ## 输入
@@ -32,3 +37,7 @@ orch --db TMPDIR/coord.db --json status --run run_blog_001
 
 - 任务终态依赖 `reconcile` 落回 `orch`，而不是由 worker 直接改写 task 表
 - run 级聚合状态会随终态任务一并刷新
+
+## 补充约束
+
+- 如果 task 声明了 required checks，worker `done` 不应再直接进入 `done`；那条分支由 `reconcile-maps-done-thread-to-verifying-when-task-has-required-checks.md` 覆盖

docs/tests/orch/reconcile/reconcile-maps-done-thread-to-verifying-when-task-has-required-checks.md

@@ -0,0 +1,42 @@
+# Case: `reconcile-maps-done-thread-to-verifying-when-task-has-required-checks`
+
+## 用例意义
+
+验证 `reconcile` 在 worker 报 `done` 之后，如果任务声明了 required checks，不会直接把 task 置为 `done`，而是先推进到 `verifying`。
+
+## 前置条件
+
+- 已存在带 required checks 的任务
+- 该任务已经 dispatch 并被 worker claim
+- worker 已对该 thread 执行 `done`
+
+## 输入
+
+```bash
+orch --db TMPDIR/coord.db --json run init --run run_verify_001 --goal "Exercise verification gates"
+orch --db TMPDIR/coord.db --json task add \
+  --run run_verify_001 \
+  --task T1 \
+  --title "Implement verifier-backed task" \
+  --default-to worker-a \
+  --spec-file TMPDIR/task.md \
+  --check-profile cadence_component \
+  --required-check lint \
+  --required-check test
+orch --db TMPDIR/coord.db --json dispatch --run run_verify_001 --task T1 --execution-mode analysis --body "Implement the gated task."
+inbox --db TMPDIR/coord.db --json claim --agent worker-a --thread THREAD_ID
+inbox --db TMPDIR/coord.db --json done --agent worker-a --thread THREAD_ID --summary "Implementation finished" --body "Ready for verification."
+orch --db TMPDIR/coord.db --json reconcile --run run_verify_001
+```
+
+## 预期输出
+
+- `reconcile` 退出码为 `0`
+- `data.updated_tasks` 包含 `T1`
+- `T1.status == "verifying"`
+- 后续 `orch verify status --run run_verify_001 --task T1` 返回 `data.gate.status == "pending"`
+
+## 断言结论
+
+- worker 的 `done` 不再自动等同于 task `done`
+- 一旦 task 定义了 required checks，`reconcile` 的职责是把它送入验证门，而不是直接宣布完成