fix: agent capability matching in dispatch — only agent: labels are requirements

Previous bug: only code:* and review labels were checked, so agent:document,
agent:tests etc. were never filtered. Any agent could pick up any task.

Now: labels with agent: prefix are matched against agent capabilities.
Other labels are treated as metadata. Includes regression test.

docs/agent-onboarding-guide.md

@@ -298,12 +298,17 @@ curl -X POST http://FLEET_API_URL:PORT/api/v1/agents/deregister \
 
 ```
 created → assigned → running → review_pending → completed
-                               ↘ failed
-                  ↘ agent_lost
-         ↘ cancelled
+    ↓         ↓          ↓          ↓          ↓
+cancelled   cancelled   failed    failed    cancelled
+                         ↓
+                   (retry) → assigned
 ```
 
-Any `failed` or `agent_lost` task can be retried via `POST /api/v1/tasks/{task_id}/retry` (transitions to `assigned`). Retry is limited by `max_retries` (default: 2).
+**Notes:**
+- `failed` and `agent_lost` tasks can be retried via `POST /api/v1/tasks/{task_id}/retry` (transitions to `assigned`)
+- Retry is limited by `max_retries` (default: 2)
+- `agent_lost` is set internally by the heartbeat checker when an agent times out
+- `review_pending` can transition back to `assigned`, `running`, `failed`, or `completed`
 
 ---