fix: require human-authorized tracker intake

[nhod-codex]

Summary

• make issue assignment the tracker-intake authorization boundary
• reject empty and none assignee selectors and fail closed in observer matching
• frame orchestrators as supervisors of authorized work, not ticket generators or competing dispatchers
• tell workers to fold related defects into their current PR and propose separate work for human authorization
• remove the standing-prompt confidentiality guard so operators can inspect injected policy

Context

This is the upstream-applicable core of polymath-ventures#303. The downstream fork also has Prime orchestration, worker concurrency caps, retry policy, routing labels, and historical nopool metadata; those controls do not exist on upstream main and are intentionally outside this PR.

Verification

• cd backend && go build ./...
• cd backend && go vet ./...
• cd backend && go test ./...