feat(cloud): add targeted task governance foundation

tests/test_task_scheduler.py

@@ -225,3 +225,42 @@ def test_capability_tag_constraint_filters_candidates(tmp_path) -> None:
     assignments = scheduler.assign()
     assert [a.task_id for a in assignments] == [task_id]
     assert assignments[0].device_id == "dev-2"
+
+
+def test_explicit_host_and_device_target_is_a_hard_constraint(tmp_path) -> None:
+    pool = _pool_with_devices(tmp_path, _device("host-a-device"), host_id="host-a")
+    pool.sync_host_devices("host-b", [_device("host-b-device")])
+    scheduler = TaskScheduler(pool, pool.store, _config())
+
+    task_id = scheduler.submit(
+        goal="target host b",
+        constraints=TaskConstraints(
+            target_host_id="host-b",
+            target_device_id="host-b-device",
+        ),
+    )
+
+    assignments = scheduler.assign()
+
+    assert [(item.host_id, item.device_id) for item in assignments] == [
+        ("host-b", "host-b-device")
+    ]
+    task = pool.store.get_task(task_id)
+    assert task is not None
+    assert task.constraints.target_host_id == "host-b"
+    assert task.constraints.target_device_id == "host-b-device"
+
+
+def test_unavailable_explicit_target_is_never_rerouted(tmp_path) -> None:
+    pool = _pool_with_devices(tmp_path, _device("host-a-device"), host_id="host-a")
+    pool.sync_host_devices("host-b", [_device("host-b-device", status="busy")])
+    scheduler = TaskScheduler(pool, pool.store, _config())
+    task_id = scheduler.submit(
+        goal="wait for host b",
+        constraints=TaskConstraints(target_host_id="host-b"),
+    )
+
+    assert scheduler.assign() == []
+    task = pool.store.get_task(task_id)
+    assert task is not None
+    assert task.status == "queued"