fix: initialize task_json in track_iteration_start

[alilxxey]

Under set -uo pipefail, local task_json without an initializer leaves the variable unset. When the pending queue is empty (iteration 2+ with no tasks left), next_task_context is empty, the enrichment if block is skipped, and the subsequent [[ -z "$task_json" ]] check crashes with "unbound variable", killing the run.

Initialize local task_json="" at declaration and guard reads with ${task_json:-} and ${next_task_context:-} for defense in depth. Adds BUG-RUN-003 regression assertions to tests/test-bugfix-audit.sh.

Description

Fixes a crash in track_iteration_start where local task_json was
declared without initialization. Under set -uo pipefail, when the
pending queue becomes empty (iteration 2+ after all tasks are done),
next_task_context is empty, the enrichment if block is skipped,
and the subsequent [[ -z "$task_json" ]] check crashes with
"unbound variable", killing the run and blocking further iterations.

Reproduction

On v6.75.3 with any PRD:

1. loki start prd.md
2. First iteration completes
3. Council votes REJECT (or pending queue otherwise empties)
4. Second iteration starts → crash: task_json: unbound variable

Fix

• Initialize local task_json="" at declaration (autonomy/run.sh:3602)
• Defensive reads: ${task_json:-} / ${next_task_context:-}
• Explicit fallback || task_json="" if the python3 heredoc exits non-zero

Audit

Scanned run.sh for the same anti-pattern (local var without init →
conditional if assignment → unconditional read). Found 8 candidates;
all 7 use if/else with assignment in both branches (safe) and 1 uses
if ! var=$(...) which assigns inside the condition (safe). task_json
was uniquely vulnerable because it had an if without an else.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that changes existing behavior)
• Documentation update
• Refactor (no functional changes)
• Test improvement

Checklist

• Shell scripts pass syntax validation (bash -n autonomy/run.sh && bash -n autonomy/loki)
• All existing tests pass
• New tests added for new functionality (where applicable)
• No emojis in code, comments, documentation, or commit messages
• Version bumped in all required files (if this is a release -- see CLAUDE.md Release Workflow)
• Code follows existing patterns and style conventions

CLA Acknowledgment

• I have read and agree to the Contributor License Agreement

Related Issues

Closes #

[github-actions]

All contributors have signed the CLA. Thank you.
_{Posted by the CLA Assistant Lite bot.}

[alilxxey]

I have read the CLA Document and I hereby sign the CLA