feat(spaces): let claimed tasks move between Kanban columns and let any writer take a claim over

[ValentinKolb]

Outcome

• A claimed task can be dragged between open Kanban columns (and between done columns) again, by its holder and by anyone else who can edit the Space. Before, every such move failed with 409.
• Claims coordinate work instead of locking it: any writer, not only a Space admin, can take over another account's claim. In the task details, Take over does this directly. Completing or reopening someone else's claimed task from the board, the list, the calendar tray or the details asks once ("Claimed by Jana Berger – take over and complete?") and then takes the claim over and completes the task in one request. Cancel leaves the card where it was.
• A wormhole transfer of a claimed task works the same way. The holder's own claim ends without a question; someone else's is taken over after one confirmation ("Claimed by X – take over and move?"). Before, every claimed task was refused.
• Take-overs are recorded as task.taken_over activity with the previous holder. The previous holder's next progress, release or done call with the ended claim ID gets 409 "Task claim is no longer active", also when the task has been claimed again since. Before, it got "Task is claimed; release its current claim …", which told it to release someone else's claim.
• A move without completed now follows the target column's done state on the server, so a stale board can no longer leave a completed task in an open column.
• API, CLI and capability surface: force on POST …/items/:itemId/move, POST …/completed, task.set-completed and cld spaces done --force, plus an optional { claimId, force } body on the wormhole transfer route. release --force / task.release with force now need write access instead of admin access.

Root cause

The board sent the target column's completion state with every move, and the server checked the claim whenever completed was present, not only when it changed. The board sent the claim ID only when the target was a done column. Every move of a claimed task therefore hit the claim check and failed, even between open columns and even for the holder.

The server now checks the claim only for a change of completion state (or when a call names a claim), against the current state inside the locked transaction. A move that keeps the state also keeps the completion time. The board sends completed only when it changes, with the reader's own claim ID in both directions. Wormhole transfers end the claim because the task leaves the Space whose grants backed it, so they are guarded like completion.

The details panel used to send a confirmed take-over to whatever item it showed once the dialog closed; it now drops the answer when the item changed.

Documentation

• Fibel: docs-site/apps-content/en/spaces.md (claim semantics, take-over, wormhole transfers, move without completed, CLI and capability notes).
• Built-in Help EN/DE: spaces-workflow.help.md; the help-writing baseline loses the two "admins"/"Adminzugriff" findings the new text no longer has.
• CLI reference packages/spaces/src/cli-references/index.md, capability and OpenAPI descriptions.
• cloud-dev skill unchanged: this is Spaces-owned claim behavior, not a cross-cutting platform invariant or development workflow.

Verification

Rebased onto main at 433d13e, then:

• bun run check: 24/24 rules pass (incl. typecheck, localization, help-writing, capability-presentation).
• bun run test --integration --filter packages/spaces against the local test infrastructure: 28/28 suites pass, including task-work.integration.test.ts (moves between open columns by holder and colleague, a done-to-done move keeping the completion time, take-over activity, ended-claim 409) and wormholes.test.ts (holder transfer, forced take-over of the exact claim, refusal without the claim).
• Focused Spaces unit, render and behavior tests: wormholes, capabilities, cli (92 pass, 7 skipped integration-gated), ItemDetailPanel/ItemRow/ClaimControls/Calendar render (56 pass), and the claim-take-over, kanban-drop-indicator, feedback-channels, list-filter-interactions, list-search behavior tests (18 pass).
• git diff --check and Biome on the changed files are clean.
• Not run locally: the Kanban browser suite (kanban-board.browser-suite.ts) and the full repository test run; the gate runs both.

Three later main commits (mail, ai, dashboard) touch none of these files; the merge queue re-runs the gate on the merge result.