[finish] Shared account tokens: make the NodeLink flow

Terminal analytical phase: verify every build subtask has completed and resolved, optionally note UI acceptance evidence, then settle. Dispatched as a read-only runner role (feat/finish-as-runner, ADR-0040) whose settle is server-computed (`task.settle` declaring a `finish` terminal) — the server derives the full finish report and flips this child `-> done`; the runner attests nothing. Readied by the fan-out sweep like its siblings; its dependency edges to every coder keep `dispatchable_tasks` from dispatching it until those deps are done.

All 7 coders done, 10 PRs merged; dialog, storage cards, Shared machines page and owner picker seen on dev. No NodeLink exists on dev, so the core flow is unproven live. Filed 6451 (live e2e), 6452/6453/6454 (security gaps), 6455 (UI polish).