#11510 feat(tasks): per-task sync scope — keep tasks private to the Ever platform

Why

The owner wants to control which tasks get synced to integrations. Concretely: internal tasks copied from agent handovers into our tenant must never sync to GitHub (or any third-party integration), but must sync to Ever Works (part of the Ever platform), so Ever Works can help work on them.

Until now each integration decided alone (GitHub: project with a synced repo + auto-sync + the sync label on the task). There was no per-task switch.

What

New nullable column task.syncScope (TaskSyncScopeEnum):

Value	Who may sync the task out of Gauzy
all (or null, every existing task)	every enabled integration, by its own rules — unchanged behaviour
ever-platform	only first-party Ever integrations (Ever Works); never GitHub, Sim, …
none	no integration

• isTaskSyncAllowed(task, 'third-party' \| 'ever-platform') in @gauzy/contracts (pure; plugin specs mock @gauzy/core, so it lives in contracts). Unknown values are read as none.
• GitHub outbound (GithubTaskUpdateOrCreateHandler): returns early unless the scope allows third-party.
• Sim task-event handler: same.
• Ever Works task push (taskSyncExclusion, shared by task + comment handlers) and idea push: skip only none.
• TaskService.update: the save returns only the written columns, so the UPDATED event of a partial update carried no syncScope; the stored value is now kept on the returned task (same pattern as the existing organization/title fallback), so a partial update of a private task can't look like all.
• Migration 1791000003410-AddTaskSyncScope (Postgres / SQLite / MySQL, idempotent, advisory/named lock, no backfill; nullable column = catalog-only on PG 11+). Template: 1791000003320-AddEquipmentSharingVersion.
• Settable through the REST create/update DTOs (they derive from the entity). No UI control yet — follow-up.

Not in this PR

• UI control in the Gauzy task dialog / Ever Teams.
• GraphQL Task type field.

Test

• packages/core/src/lib/tasks/task-sync-scope.spec.ts (helper truth table). Nothing else run locally (fast-build rule).

🤖 Generated with Claude Code