TaskFlow ops: graceful, honest, observable

Implement TaskFlowOps (milestones 3+4): - shutdown() — stops intake (running = False), requeues in-flight count into requeued, zeroes in_flight, marks drained = True - job(job_id, principal) registers ownership; status_for(job_id, principal) returns the status dict for the owner, None for anyone else (no forbidden distinction, no as_user parameter to trust) - log(level, event, job_id=None, **fields) — appends a sorted-keys JSON line with correlation_id set to job_id, redacting any of password/token/secret/card_number as '[REDACTED]' - trip_breaker() / readiness() — readiness returns {'ready': running and not breaker_open, 'checks': {'intake': ..., 'dependencies': ...}} Restart-readiness: after shutdown(), all work is in requeued and nothing is lost.

Difficulty: advanced