[finish] Jarvis Deep Links and Read-Only Tools

Terminal analytical phase: verify every build subtask has completed and resolved, optionally note UI acceptance evidence, then settle. Dispatched as a read-only runner role (feat/finish-as-runner, ADR-0040) whose settle is server-computed (`task.settle` declaring a `finish` terminal) — the server derives the full finish report and flips this child `-> done`; the runner attests nothing. Readied by the fan-out sweep like its siblings; its dependency edges to every coder keep `dispatchable_tasks` from dispatching it until those deps are done.

Epic delivered: all 7 coders merged (#4522–#4536), the full ask is met in code, and switches are off by default with per-tenant override. Filed follow-up 5152 (no create_ticket after a console read, security L1). Dev was unreachable from this node, so there was no live browser check.