[Review] Restrict type-transition preview text to supported card operations

[Chris0Jeky]

MEDIUM found in the independent authority/proposal review of #2949 at c9fccd4. Source-traced, not runtime-reproduced.

A valid card/move proposal with an extra workItemType: "Epic" parameter passes the move validator. AutomationProposalService.BuildReadableDiff appends Task -> Epic for generic card actions, but the move handler ignores that parameter. The actual move remains authorized and atomic; the preview incorrectly claims an additional type change. Ordinary MCP create/update paths construct supported payloads.

Residual acceptance: render a type transition only for operations that actually support it, or reject unsupported workItemType parameters consistently before preview. Regress move plus an extra type field and preserve valid create/update preview/apply behavior. No broad operation-vocabulary redesign.

Tracked separately under the bounded review rule; not an authorization bypass. Requested Project Pending, Priority III, v0.4.

[Chris0Jeky]

[Claude lane claim v2]

• Lane: alpha-product-trust
• Base SHA: c565a631a6a821b83e44145f7152caa81e7b8d2b (origin/main), branch issue-2950/type-transition-preview, worktree C:/wt/td-2950
• Owned paths (exclusive while this claim is open):
  • backend/src/Taskdeck.Application/Services/Pipeline/ProposalOperationContractValidator.cs
  • backend/src/Taskdeck.Application/Services/AutomationProposalService.cs
  • backend/tests/Taskdeck.Application.Tests/Services/Pipeline/ProposalOperationContractValidatorTests.cs
  • backend/tests/Taskdeck.Application.Tests/Services/AutomationProposalServiceTests.cs
• Shared-path leases: autodoc/interfaces/proposal-operation-vocabulary.md (one sentence on the card-parameter contract, append-only).
• Explicitly NOT touched: backend/src/Taskdeck.Application/Services/Pipeline/OperationHandlerRegistry.cs and backend/src/Taskdeck.Application/Services/AutomationExecutorService.cs (open PR Publish archive/restore lifecycle notifications only after the proposal commits (#2934) #3016 owns those).
• Parallel-safe work: any frontend, CI, docs outside the autodoc interface file, and any backend area outside the proposal preview/contract seam.
• Status: in progress, backend-only slice. Validator-rejection path preferred per the issue's acceptance; the diff builder gets a matching guard. Release marker with head SHA and result follows.

[Chris0Jeky]

[Claude lane release v2]

• Lane: alpha-product-trust
• Head: 12d801c031ea1f9885317c0ad19e96876c724ab8 on issue-2950/type-transition-preview (PR fix(proposals): reject workItemType on card actions that ignore it (#2950) #3027, READY, not merged).
• Result: fixed via contract-validator rejection (the route the acceptance preferred) plus a matching
  create/update-only guard in the readable-diff renderer. Parameter 'workItemType' is not supported by card action '<action>' now fails preview and apply together; create/update type transitions
  still render and apply.
• Owned paths released: ProposalOperationContractValidator.cs, AutomationProposalService.cs, and
  their two test files. Shared-path lease released:
  autodoc/interfaces/proposal-operation-vocabulary.md (one appended bullet after the add-label
  entry; PR Publish archive/restore lifecycle notifications only after the proposal commits (#2934) #3016 edits the archive-lifecycle bullet in the same file, so the two do not overlap
  textually).
• Not touched: OperationHandlerRegistry.cs, AutomationExecutorService.cs (PR Publish archive/restore lifecycle notifications only after the proposal commits (#2934) #3016 owns them).
• Base note: main advanced to 181e2dbb2 (Validate cumulative WIP when a proposal restores a card behind other operations (#2926) #3019) mid-slice; that was merged into the branch and the
  whole gate was re-run against the merged head.
• Verification at that head: dotnet test backend/Taskdeck.sln -c Release -m:1 exit 0 — 9509 passed,
  0 failed, 34 skipped; node scripts/check-docs-governance.mjs and node scripts/check-doc-links.mjs
  both pass. No frontend/E2E run (backend-only slice).