fix: parse TaskList output without ambiguous regex

[jsgrrchg]

Summary

• Replace the ambiguous regex used to parse textual TaskList output with linear string parsing.
• Preserve support for owners, multiple dependencies, and malformed suffixes treated as subject text.
• Add a regression test covering adversarial input.

This addresses a potential ReDoS reported by CodeQL without changing the structured JSON path.

Closes #1005.

Testing

• npm run test:run
• npm run build
• npm run check