fix: taskgraph frontmatter variants — scope medium -> moderate, status done -> completed

tunnels/tunnel-listener + tunnels/forwarded-receipt used `scope: medium`
(not a valid variant — single/narrow/moderate/broad/system), which made
taskgraph silently drop both from the graph (validate failed; topo/
list missed them). tunnels/coverage-weak-spots used `status: done`
(pre-existing; valid variants are pending/in-progress/completed/failed/
blocked).

Verified: taskgraph validate (22 tasks), topo, cycles (none),
parallel, critical all resolve with the full graph.

tasks/tunnels/coverage-weak-spots.md

@@ -1,7 +1,7 @@
 ---
 id: tunnels/coverage-weak-spots
 name: "Coverage weak spots — CLOSED (2026-09-09 second pass): the UdpHalf sender-block recipe found, feed infallible, wrappers covered"
-status: done
+status: completed
 depends_on: [tunnels/review-impl]
 scope: single
 risk: low

tasks/tunnels/forwarded-receipt.md

@@ -3,7 +3,7 @@ id: tunnels/forwarded-receipt
 name: Forwarded-op serving side + TunnelSession adopt path (the opener half)
 status: pending
 depends_on: [tunnels/bindfirst-params]
-scope: medium
+scope: moderate
 risk: medium
 impact: component
 level: implementation

tasks/tunnels/tunnel-listener.md

@@ -3,7 +3,7 @@ id: tunnels/tunnel-listener
 name: TunnelListener — the listen-flow consumer session (ADR-008 §4)
 status: pending
 depends_on: [tunnels/bindfirst-params, tunnels/forwarded-receipt]
-scope: medium
+scope: moderate
 risk: medium
 impact: component
 level: implementation