Returns a single task if the caller is its initiator, a listed approver, a tenant/org-matched executor, or GLOBAL_ADMIN. Returns 404 (not 403) if the task doesn't exist or the caller cannot see it, so callers cannot probe for the existence of a taskId they aren't authorised to read.