v4928.1.5.31 — identity mismatch repair

Improves task detail identity guard after fiscal customer detach: if the opportunity customer name is still polluted, the UI prefers the process/company hint from the subject.
Extends scripts/audit_task_identity_mismatch.py with .env loading and a safe --apply mode.
--apply detaches only unsafe opportunities.local_customer_id, updates opportunity display name/email from the process hint/contact email, and records an audit trail in metadata.
No customer records are deleted.