Agent ignores explicit user instruction to stop after a single task and proceeds to implement

## Bug Description

When a user explicitly scopes a request to a **single, bounded task** (e.g. "insert the plan into the roadmap"), the agent completes that task correctly but then **autonomously continues implementing** subsequent work that was not requested, requiring the user to intervene twice to halt execution.

## Steps to Reproduce

1. User runs a `[[PLAN]]` session to plan a feature (Bootstrap navbar).
2. User approves the plan and exits plan mode (`Shift+Tab → autopilot`).
3. User sends a follow-up message: *"insert a comprehensive plan to add bootstrap menu to this project in `docs/ROADMAP.md`"* (edit a single file).
4. Agent correctly inserts the roadmap section **and** then — without any additional instruction — proceeds to:
- Run `npm install bootstrap bootstrap-icons`
- Modify `package.json` / `package-lock.json`
- Begin editing source files
5. User is forced to manually interrupt ("Wait! Don't implement now.").
6. Agent acknowledges, but on the **next turn** (triggered by the `task_complete` not-yet-available notice) it resumes implementation again.
7. User must intervene a second time.

## Expected Behaviour

When the user's instruction unambiguously targets a single artifact ("insert X into Y"), the agent should:
- Complete only that task.
- Stop and confirm before proceeding to dependent or follow-up work that was **not explicitly requested**.

## Actual Behaviour

The agent treats the prior plan (stored in `plan.md` and SQL todos) as a work queue and automatically drains it, even when the immediate user instruction covered only one item from that queue.

## Root Cause Hypothesis

The agent has access to a SQL `todos` table populated during plan mode. After completing the requested task (`roadmap-insert`), the `task_complete`-is-not-yet-available notice triggers a continuation loop, and the agent interprets its own todo list as authorisation to keep working rather than pausing for user confirmation.

## Impact

- User must interrupt the agent multiple times per session to prevent unintended file changes and `npm install` side-effects.
- Unreviewed changes land in the working tree (e.g. `package.json`, `package-lock.json` modified, then had to be reverted).

## Environment

- GitHub Copilot CLI version: 1.0.12
- Model: Claude Sonnet 4.6 (`claude-sonnet-4.6`)
- OS: Linux
- Project: `guia_turistico` (SPA, Node/TypeScript)

## Suggested Fix

- After completing the explicitly requested task, the agent should **not** autonomously continue with items from the internal todo queue without a new explicit user instruction.
- The `task_complete` unavailability notice should not be treated as a signal to resume work — it should be a no-op when the user's immediate request has been fulfilled.