feat(v3.19): POST /tasks/create skill_id validation + _create_task propagation

Author: J.A.R.V.I.S.

relay/acp_relay.py

@@ -13987,13 +13987,27 @@ async def _send_fed():
                         return
                     # Attach validated token fields to task for audit
                     log.info(f"🎫 capability_token validated: jti={raw_cap_token.get('jti')} skill={skill_id_for_tier}")
+                # ── v3.19: skill_id routing — validate skill exists in AgentCard ──────────
+                if skill_id_for_tier:
+                    _skill_valid, _skill_err = _validate_skill_id(skill_id_for_tier, peer_id=caller_peer_id)
+                    if not _skill_valid:
+                        self._json({
+                            "ok":         False,
+                            "error_code": ERR_SKILL_NOT_FOUND,
+                            "error":      _skill_err,
+                            "skill_id":   skill_id_for_tier,
+                            "peer_id":    caller_peer_id,
+                        }, 400)
+                        return
+
                 # v2.51: T3 human_confirmation_required gate
                 t3_confirm = _needs_human_confirmation(skill_id_for_tier)
                 task = _create_task(payload,
                                     message_id=body.get("message_id"),
                                     task_id=body.get("task_id"),       # BUG-006 fix: pass client task_id
                                     context_id=body.get("context_id"), # v1.7: propagate context_id to SSE events
-                                    initial_state=TASK_CONFIRMATION_PENDING if t3_confirm else None)
+                                    initial_state=TASK_CONFIRMATION_PENDING if t3_confirm else None,
+                                    skill_id=skill_id_for_tier)  # v3.19: skill_id routing
                 # v2.52: audit skill_id + peer_id at task creation
                 if skill_id_for_tier:
                     _audit_card_skills = (_status.get("agent_card") or {}).get("skills", [])