fix(tasks): reject client-supplied signals_scout task origin

origin_product was API-settable to signals_scout (only image_builder was
rejected), so any task:write caller could forge a scout task whose
appended run logs would be mirrored into PostHog's internal Logs project
once the mirror ships - flagged by the security review bots on the PR.

Scout tasks are created exclusively server-side by the signals scout
harness via the tasks facade, so treat signals_scout like image_builder:
an internal-only origin the public serializer rejects. With creation
server-attested, mirroring_enabled() can keep gating on origin_product.
The mirror is new in this PR, so no forged tasks can predate the check
where it matters.

Test: parameterized serializer-level SimpleTestCase over the internal-only
origins (verified to fail without the fix); the existing image_builder
endpoint test remains the wiring guard.

Generated-By: PostHog Code
Task-Id: 0c511836-2180-455a-9b58-45df2a0661ec

Author: tatoalo

products/tasks/backend/presentation/serializers.py

@@ -595,6 +595,11 @@ def validate_origin_product(self, value):
         """Reject internal-only origins that are set by server-side flows, never by API callers."""
         if value == tasks_facade.TaskOriginProduct.IMAGE_BUILDER:
             raise serializers.ValidationError("origin_product 'image_builder' is reserved for image-builder sessions")
+        if value == tasks_facade.TaskOriginProduct.SIGNALS_SCOUT:
+            # Scout tasks are created only by the signals scout harness. A forged scout origin
+            # would route the task's run logs into PostHog's internal Logs project
+            # (run_log_mirror) and inherit scout visibility semantics.
+            raise serializers.ValidationError("origin_product 'signals_scout' is reserved for signals scout runs")
         return value
 
     def validate_repository(self, value):

products/tasks/backend/tests/test_presentation_serializers.py

@@ -9,9 +9,24 @@
 from products.tasks.backend.presentation.serializers import (
     TaskRunCreateRequestSerializer,
     TaskRunLivingArtifactCreateRequestSerializer,
+    TaskWriteSerializer,
 )
 
 
+class TestTaskWriteSerializerOriginProduct(SimpleTestCase):
+    @parameterized.expand(
+        [
+            ("image_builder", True),
+            ("signals_scout", True),
+            ("user_created", False),
+        ]
+    )
+    def test_internal_only_origins_are_rejected(self, origin_product: str, expected_rejected: bool) -> None:
+        serializer = TaskWriteSerializer(data={"origin_product": origin_product})
+        serializer.is_valid()
+        assert ("origin_product" in serializer.errors) is expected_rejected
+
+
 class TestTaskRunLivingArtifactCreateRequestSerializer(SimpleTestCase):
     @parameterized.expand(
         [