fix(api): allow scoped runtime task updates

[rogerchappel]

Summary

• allow authenticated OpenClaw runtimes to update task status and add comments
• enforce that bearer-authenticated mutations are limited to the runtime accessible workspace
• preserve session-authenticated behavior for human users

Why

The CrewCmd agent contract requires task claims, status transitions, and audit comments, but those mutation endpoints accepted browser sessions only. Runtime workers could create and read tasks but could not advance them.

Verification

• pnpm exec eslint src/app/api/tasks/[id]/route.ts src/app/api/tasks/[id]/comments/route.ts
• pnpm typecheck
• pnpm vitest run src/app/api/tasks/route.test.ts
• live bearer canary: claim task, add pickup comment, requeue task