feat(taint): stage 1 of argument provenance — the tap records hosts fetched content named

The "derived from untrusted content" half of ActGov's invariant (no outbound
action whose target came from untrusted content). Observed only; no rule
reads it yet.

- the tap runs a node extractor only when a payload could be a fetch
  (WebFetch, WebSearch, curl/wget in command position) and appends the
  response's URL hosts, minus the agent's own target, to
  untrusted-hosts.txt beside the tap — a path hook-files already protects
- capped at 500, deduplicated, and the tap still always exits 0
- both tiers drain it per finished phase into a taint.hosts event
- shell-tested against the generated hook with the real node; the test caught
  `grep -r curl docs` being read as a fetch

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/TASK-PERMISSION-AND-TAINT.md

@@ -114,6 +114,16 @@ intersection.
 **Staging.**
 1. Taint extraction in the tap, writing the file. Nothing enforced. Inspect on
    real missions: what does it actually collect?
+
+   **Built 2026-09-22.** `vm_tool_tap::NODE_TAINT` runs in the tap only when the
+   payload could be a fetch; the file is `untrusted-hosts.txt` in the tap's own
+   directory (covered by `hook-files` on both tiers, tested), capped at
+   `MAX_TAINT_HOSTS` = 500, drained per finished phase into `taint.hosts`.
+   Rules fixed by its shell test: `curl`/`wget` count only in command position
+   (`grep -r curl docs` is not a fetch), and a host that also appears in the
+   agent's own command or WebFetch `url` is the agent's choice, not the
+   page's. Known gap: `curl -o page.html` then `Read page.html` taints
+   nothing. The fetched body never passes through a fetching call's response.
 2. `untrusted-target` in shadow (`gate.would_deny`), same as piece 1.
 3. Enforce on the **container tier**, where public egress is open. On the VM
    tier it is defence in depth behind an allow-list that already holds.