feat(templates): tiered escalation ladder — remove airouter-eligible gate

Remove `tags_required: [airouter-eligible]` from airouter-impl-ready so all
non-skip tasks route through the full airouter→sonnet→opus ladder automatically.
Add `airouter-skip` to airouter's tags_forbidden so opt-out tasks go directly
to sonnet from attempt 0.

Relax sonnet-impl-ready tags_forbidden (drop multi-file + algorithmic-large)
so sonnet handles complex tasks at escalation tier without template rejection.

Add opus-impl-ready@1.yaml — last-resort escalation, code-opus-tdd-repo
composite, scope_budget 5 files / 400 lines / 3600s.

task-templates/workflow/opus-impl-ready@1.yaml

@@ -0,0 +1,26 @@
+name: opus-impl-ready
+version: 1
+description: Impl of a spec requirement against pre-validated tests, Opus in worktree (last-resort escalation from Sonnet)
+runtime: code-opus-tdd-repo
+input:
+  state: scaffolded
+  tags_forbidden: [security-sensitive]
+  required_artifacts: []
+output:
+  state: impl-green
+scope_budget:
+  files_modified_max: 5
+  lines_diff_max: 400
+  wall_clock_seconds_max: 3600
+nodes:
+  - id: agent
+    kind: agent
+    template: code-opus-tdd-repo
+    runtime_env:
+      # WF-COMP-15: stage agents share one per-item work branch so their work
+      # accumulates (test-write -> scaffold -> impl -> integrate -> merge all
+      # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
+      # clones and the agent's output evaporates (E2E 2026-07-04).
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "task/${item.uuid}"
+    prompt: "Implement the task. ${metadata.automation.test_files}${metadata.automation.spec_ids}Task description: ${artifacts.item_title}. ${artifacts.item_body}"