fix(taskctl): add allowImmutable=true to verdict command Store.updateTask

[randomm]

Summary

• The verdict command in tool.ts called Store.updateTask without allowImmutable=true, causing adversarial agents to fail when submitting verdicts with the error: Cannot update immutable fields: pipeline
• Same class of bug as fix(taskctl): retry and override commands fail — pipeline field immutability guard not bypassed #265 (retry/override) — missed in PR fix(taskctl): handle adversarial-running in resurrectionScan, store pulse_pid, fix retry/override immutability #266
• Fix: one-line change, adding true as the fourth argument to Store.updateTask
• TDD: test written first (verified failing), then fix applied

Fixes #267