fix(task-tool): add task ID validation and improve lock acquisition safety

- Add task ID pattern validation (T-[A-Za-z0-9-]+) to prevent path traversal
- Refactor lock mechanism to use UUID-based IDs for reliable ownership tracking
- Implement atomic lock creation with stale lock detection and cleanup
- Add lock acquisition checks in create/update/delete handlers
- Expand task-reminder hook to track split tool names and clean up on session deletion
- Add comprehensive test coverage for validation and lock handling

src/plugin-config.ts

@@ -113,7 +113,7 @@ export function loadPluginConfig(
 
   // Load user config first (base)
   let config: OhMyOpenCodeConfig =
-    loadConfigFromPath(userConfigPath, ctx) ?? { new_task_system_enabled: false };
+    loadConfigFromPath(userConfigPath, ctx) ?? {};
 
   // Override with project config
   const projectConfig = loadConfigFromPath(projectConfigPath, ctx);
@@ -121,6 +121,11 @@ export function loadPluginConfig(
     config = mergeConfigs(config, projectConfig);
   }
 
+  config = {
+    ...config,
+    new_task_system_enabled: config.new_task_system_enabled ?? false,
+  };
+
   log("Final merged config", {
     agents: config.agents,
     disabled_agents: config.disabled_agents,