[finish] jaahd: no credentialed or daemon-uid git ever reads

Terminal analytical phase: verify every build subtask has completed and resolved, optionally note UI acceptance evidence, then settle. Dispatched as a read-only runner role (feat/finish-as-runner, ADR-0040) whose settle is server-computed (`task.complete` declaring a `finish` terminal) — the server derives the full finish report and flips this child `-> done`; the runner attests nothing. Readied by the fan-out sweep like its siblings; its dependency edges to every coder keep `dispatchable_tasks` from dispatching it until those deps are done.

All 4 coders merged (#6066, #6012, #6013, #6023); 565 isolation tests pass on develop, denylist gone. Filed 7529 (preflight full-clone regression) and 7530 (mirror sweep). Dev check unverified: dev.jaah.ai unreachable.