Operator cannot release tenant slot held

Found while enabling MicroVM for GMind on prod (task 9751). Two GMind tasks in project jaah, #7294 "Scrub and Consolidate Documentation via CLAUDE.md" (Running since 2026-10-18, idle 6 days) and #6352 "Implement Five Repo Code Reduction Opportunities" (Running), hold static slots on nodes h1 and h6-3. Nobody in the console can end those holds: 1. As the operator (not acting as), the node page's Release and the pool page's bulk Release both answer 403 "This belongs to GMind. Act as GMind to change it." for a slot on a GMind node or a GMind project. 2. Acting as GMind (Owner seat), /tasks/7294 and /tasks/6352 render "Task not found", and the node page's Held cell shows the task number without a Release button (the slot's may_edit is false because the task's write clause fails for the act-as principal). Sibling tasks #9745, #9751, #9753 in the same project are visible and releasable in act-as. 3. As the operator, the task page reads fine (title, org GMind, state Running) but every write 404s: Reset on #7294 returned 404 from POST /api/tasks/7294/reset and the page shows "not found". Requirements: - A task the operator can read on the task page must accept the operator's writes (Stop, Reset, Change state) or say why it refuses; a 404 on a row the page just rendered is a defect. - Act-as GMind should see every task of a GMind project, or the node page's Held cell should say why a hold cannot be released from this seat ("held by a task you cannot see") instead of silently dropping the button. - The operator needs one working way to end a hold on a tenant node so a node can be marked MicroVM; today the flip (operator-only on an allocated node) and the release (tenant-only) need two seats and the release has none that works for a hidden task. - Diagnose why #7294 and #6352 are invisible to the act-as owner seat while their siblings are not (hidden flag? project membership? visibility clause) and fix the cause. Out of scope: changing the MicroVM mark rules themselves; the slot release semantics (force on a live session) are fine. Done means: - Acting as GMind, /tasks/7294 opens (or the node page's Held cell explains why it cannot be released from this seat). - As the operator, Reset on a task the task page renders succeeds or returns a readable refusal, never 404. - The hold #7294 has on h1 jaah#2 can be ended from the console by the operator in at most one seat switch. - Required checks: ./dc check quick, changed-area tests in apps/api and apps/web.

Fixed: a hidden task was invisible to the act-as seat, so the operator's act-as writes 404'd and its slot had no Release. Act-as now passes the hidden gate; node page says "not yours to release" when it can't. Quick gate + api/web tests green; reviews passed; visual check fine at 1280/390px. PR #6839 merged a4d3f61, deploy green. Memory: none applied.