fix: build task dependencies in two phases

[Bill-Billion]

Summary

• split task graph construction into create_task and update_task(addBlockedBy=...), so dependencies use IDs returned by the runtime
• reject unknown IDs, self-dependencies, cycles, duplicate edges, and dependency changes after a task has started
• keep dependency mutation Lead-only in the team runtimes and serialize s13/s15 validation plus persistence with the existing task-store lock
• update the s10, s13, and s15 lessons in all three languages, diagrams, Web scenarios, execution flow, annotations, and generated course data

Root cause

create_task previously accepted blockedBy while task IDs were generated only when the host executed the tool. Multiple sibling create_task calls in one model response therefore could not reference one another's real IDs and compatible providers could emit names or guessed IDs that failed validation.

The new contract creates every node first, returns the host-generated IDs, and adds graph edges in a later update_task turn.

Validation

• Python 3.11 full suite: 223 passed
• focused task/team/Web suite: 94 passed, 69 subtests passed
• Web production build: 118 static pages generated successfully
• extraction run twice with identical generated hashes
• source and generated SVGs rendered and visually checked in Chinese, English, and Japanese
• real API runs with the repository's configured model for s10, s13, and s15: each created four nodes, then added three dependency edges with zero tool errors and the expected persisted DAG

Closes #532