Add verified merge completion and separate operator-pending lifecycle from active execution

[douglasjarquin]

Problem

A successful Made pipeline ends in awaiting_merge, but there is no supported transition to succeeded. awaiting_merge is also treated as active by idle and shutdown logic even though pipeline execution has ended. This can leave the daemon permanently non-idle and make normal shutdown refuse after every successful validation.

Cancellation is not a valid representation of a successfully merged PR, and Made must never perform the merge itself.

Required implementation

1. Add a public structured command and daemon RPC:

   made run complete --json --merged --merge-sha <sha> <run-id>
   

2. Require the exact run to exist and be in awaiting_merge.

3. Require a recorded PR URL.

4. Verify through GitHub that:

   • the PR is merged
   • the PR belongs to the expected repository
   • the PR head corresponds to the run’s branch/input-output identity
   • the supplied merge SHA matches the real merge

5. Persist:

   • state succeeded
   • merge SHA
   • completion timestamp
   • an explicit completion message

6. Make the same completion request idempotent.

7. Reject a conflicting merge SHA.

8. Preserve the no-merge/no-auto-merge boundary: Made verifies; Consigliere or the boss merges.

9. Separate predicates for:

   • executing work
   • operator action required
   • inclusion in run list --active
   • idle-shutdown blocking
   • explicit-shutdown blocking

10. An awaiting_merge run must remain queryable and visible as action-required, but it must not require a live work goroutine or permanently block idle shutdown.

11. Preserve awaiting_merge across daemon restart.

12. Add a deliberate abandonment operation or explicit cancellation semantics for an unmerged validated PR; do not conflate abandonment with successful completion.

13. Expose merge-completion support in capabilities.

Acceptance criteria

• A verified merged PR transitions exactly one run from awaiting_merge to succeeded.
• Repeating completion with the same merge SHA succeeds idempotently.
• A conflicting SHA is rejected.
• An unmerged PR cannot be completed.
• A PR from another repository/run cannot be used to complete the run.
• Made never invokes merge or auto-merge.
• Awaiting-merge runs remain visible to operators but do not pin daemon execution forever.
• Normal daemon stop/idle semantics are intentional and tested.

Required tests

• valid merge completion
• unmerged PR rejection
• wrong PR/repository rejection
• wrong branch/head identity rejection
• same completion retry
• conflicting merge SHA retry
• restart while awaiting merge
• idle and explicit shutdown behavior with awaiting-merge records
• abandonment behavior
• proof that no production code calls gh pr merge or enables auto-merge