fix(tasks): isolate peripheral feedback writes by execution scope

An old development synchronizer could overwrite a production recovery timestamp in a shared project database even after production deployment. Check task scope before feedback or source-withdrawal writes and before idempotency replay.

Cover cross-scope rejection, same-scope success and replay, and preserve actual field feedback time when later order metadata changes.

docs/operational-task-workers.md

@@ -210,7 +210,9 @@ SQL 同时增加必填范围约束，不设置数据库默认值。回滚版本
 Worker 应连接所属环境的 `OPERATIONAL_WORKER_SERVER_URL` 和
 `OPERATIONAL_WORKER_AGENT_URL`。Server 在运行列表、领取、租约回收与
 SCADA recovery 候选查询上限制执行范围；直接领取其他范围返回
-`403 EXECUTION_SCOPE_MISMATCH`。这属于配置隔离，不能替代服务凭据授权：
+`403 EXECUTION_SCOPE_MISMATCH`。外部工单反馈与来源撤回也必须匹配任务的执行范围，
+并在幂等重放前校验；开发环境同步器不能更新生产任务或重置其恢复监测起点。
+这属于配置隔离，不能替代服务凭据授权：
 不要让本地 Worker 通过线上 Server 领取任务。普通任务与历史记录仍共用存储。
 
 修改范围配置需要重启相应 Server。暂停的本地 Worker 不会因代码更新恢复。