#766 CRITICAL: TOCTOU in orchestrator task claiming

orchestrator.py:520-530 checks claimed_by but not state='claimed'. Between claim_task() and UPDATE (separate transactions), another worker could release claim. Fix: Add AND state='claimed' to WHERE clause