fix(merge): apply the verify gate to worktree-less approvals and report it everywhere

ApproveAndMergeAsync short-circuits to Done whenever a task has no active
worktree -- which is exactly how a list-handler task works, since it commits
straight into the list working dir. The verify command was skipped for the run
that lands the most on the target branch at once; the loaded command was even
discarded at the destructuring. It now runs under the same per-repo gate as the
merge path before the task may reach Done.

The two merge entry points that did not know verify_failed reported it as
"Unknown status: verify_failed" (merge modal, dropping the command output) and
as a generic Failed (worktrees batch, claiming the merge never happened).

src/ClaudeDo.Localization/locales/de.json

@@ -661,7 +661,7 @@
     "tasksIsland": { "completedHeader": "ABGESCHLOSSEN", "completedHeaderCount": "ABGESCHLOSSEN · {0}", "planningOpenFailed": "Planungssitzung konnte nicht geöffnet werden: {0}", "planningResumeFailed": "Planungssitzung konnte nicht fortgesetzt werden: {0}", "approveFailed": "Genehmigen & Mergen fehlgeschlagen: {0}", "moveRunningRejected": "Ein laufender Task kann nicht in eine andere Liste verschoben werden.", "moveWorktreeRejected": "Verschieben nicht möglich — dieser Task hat einen aktiven Worktree, der auf sein aktuelles Repo zeigt.", "moveRepoConfirm": "Unterschiedliche Repos — {0} → {1}. Task trotzdem verschieben?", "moveConfirmUnavailable": "Verschieben nicht möglich — der Bestätigungsdialog ist nicht verfügbar." },
     "diff": { "loadFailed": "Diff konnte nicht geladen werden: {0}", "noChanges": "Keine Änderungen anzuzeigen.", "unavailable": "Diff nicht mehr verfügbar — Commit-Bereich unvollständig." },
     "planningDiff": { "hubError": "Kombinierte Vorschau konnte nicht erstellt werden (Hub-Fehler).", "conflict": "Kombinierte Vorschau nicht möglich: Teilaufgabe {0} steht im Konflikt mit einer früheren Teilaufgabe ({1} Dateien).", "buildFailed": "Kombinierte Vorschau konnte nicht erstellt werden: {0}" },
-    "merge": { "commitMessage": "Merge-Aufgabe: {0}", "workerOfflineBranches": "Worker offline — Branches können nicht aufgelistet werden.", "loadBranchesFailed": "Branches konnten nicht geladen werden: {0}", "merged": "Zusammengeführt.", "conflict": "Merge-Konflikt — Ziel-Branch wiederhergestellt. Manuell oder über Fortsetzen lösen, dann erneut versuchen.", "blocked": "Blockiert: {0}", "unknownStatus": "Unbekannter Status: {0}", "mergeFailed": "Merge fehlgeschlagen: {0}" },
+    "merge": { "commitMessage": "Merge-Aufgabe: {0}", "workerOfflineBranches": "Worker offline — Branches können nicht aufgelistet werden.", "loadBranchesFailed": "Branches konnten nicht geladen werden: {0}", "merged": "Zusammengeführt.", "conflict": "Merge-Konflikt — Ziel-Branch wiederhergestellt. Manuell oder über Fortsetzen lösen, dann erneut versuchen.", "blocked": "Blockiert: {0}", "verifyFailed": "Merge ist gelandet, aber das Verify-Kommando der Liste ist fehlgeschlagen — die Aufgabe wurde nicht auf Erledigt gesetzt.", "unknownStatus": "Unbekannter Status: {0}", "mergeFailed": "Merge fehlgeschlagen: {0}" },
     "conflictResolution": { "vsCodeError": "VS Code konnte nicht gestartet werden: {0}. Die Pfade sind oben aufgeführt — kopiere sie manuell.", "subtaskPrefix": "Konflikte in Teilaufgabe: {0}", "targetPrefix": "Zusammenführen in: {0}" },
     "settingsModal": { "workerOffline": "Worker offline — Einstellungen schreibgeschützt.", "saveFailed": "Speichern fehlgeschlagen: {0}" },
     "onlineInbox": { "workerOffline": "Worker offline — Konfiguration kann nicht geladen werden.", "saved": "Konfiguration gespeichert.", "saveFailed": "Speichern fehlgeschlagen: {0}", "signedIn": "Erfolgreich angemeldet.", "signedInNoRole": "Angemeldet, aber diesem Konto fehlt die Rolle 'user' in Zitadel — die Online-Synchronisierung wird abgelehnt, bis die Rolle im ClaudeDo-Projekt zugewiesen wird.", "signInFailed": "Anmeldung fehlgeschlagen: {0}", "signedOut": "Abgemeldet.", "signOutFailed": "Abmeldung fehlgeschlagen: {0}" },

src/ClaudeDo.Localization/locales/en.json

@@ -661,7 +661,7 @@
     "tasksIsland": { "completedHeader": "COMPLETED", "completedHeaderCount": "COMPLETED · {0}", "planningOpenFailed": "Couldn't open planning session: {0}", "planningResumeFailed": "Couldn't resume planning session: {0}", "approveFailed": "Approve & merge failed: {0}", "moveRunningRejected": "Can't move a running task to another list.", "moveWorktreeRejected": "Can't move — this task has an active worktree pointing at its current repo.", "moveRepoConfirm": "Different repos — {0} → {1}. Move the task anyway?", "moveConfirmUnavailable": "Can't move — the confirmation dialog isn't available." },
     "diff": { "loadFailed": "Failed to load diff: {0}", "noChanges": "No changes to show.", "unavailable": "Diff no longer available — commit range incomplete." },
     "planningDiff": { "hubError": "Could not build combined preview (hub error).", "conflict": "Cannot build combined preview: subtask {0} conflicts with an earlier subtask ({1} files).", "buildFailed": "Could not build combined preview: {0}" },
-    "merge": { "commitMessage": "Merge task: {0}", "workerOfflineBranches": "Worker offline — cannot list branches.", "loadBranchesFailed": "Failed to load branches: {0}", "merged": "Merged.", "conflict": "Merge conflict — target branch restored. Resolve manually or via Continue, then retry.", "blocked": "Blocked: {0}", "unknownStatus": "Unknown status: {0}", "mergeFailed": "Merge failed: {0}" },
+    "merge": { "commitMessage": "Merge task: {0}", "workerOfflineBranches": "Worker offline — cannot list branches.", "loadBranchesFailed": "Failed to load branches: {0}", "merged": "Merged.", "conflict": "Merge conflict — target branch restored. Resolve manually or via Continue, then retry.", "blocked": "Blocked: {0}", "verifyFailed": "Merge landed, but the list's verify command failed — the task was kept out of Done.", "unknownStatus": "Unknown status: {0}", "mergeFailed": "Merge failed: {0}" },
     "conflictResolution": { "vsCodeError": "Could not launch VS Code: {0}. Paths are listed above — copy them manually.", "subtaskPrefix": "Conflicts in subtask: {0}", "targetPrefix": "Merging into: {0}" },
     "settingsModal": { "workerOffline": "Worker offline — settings read-only.", "saveFailed": "Save failed: {0}" },
     "onlineInbox": { "workerOffline": "Worker offline — cannot load config.", "saved": "Config saved.", "saveFailed": "Save failed: {0}", "signedIn": "Signed in successfully.", "signedInNoRole": "Signed in, but this account is missing the 'user' role in Zitadel — online sync will be rejected until the role is granted in the ClaudeDo project.", "signInFailed": "Sign-in failed: {0}", "signedOut": "Signed out.", "signOutFailed": "Sign-out failed: {0}" },

src/ClaudeDo.Ui/ViewModels/Modals/MergeModalViewModel.cs

@@ -110,6 +110,12 @@ public sealed partial class MergeModalViewModel : ViewModelBase
                 case "blocked":
                     ErrorMessage = Loc.T("vm.merge.blocked", result.ErrorMessage ?? "");
                     break;
+                case "verify_failed":
+                    // The merge landed; only the Done transition was withheld. Deliberately not
+                    // treated as success -- no auto-close, because the failure text is the whole
+                    // point of the gate.
+                    ErrorMessage = result.ErrorMessage ?? Loc.T("vm.merge.verifyFailed");
+                    break;
                 default:
                     ErrorMessage = Loc.T("vm.merge.unknownStatus", result.Status);
                     break;

src/ClaudeDo.Ui/ViewModels/Modals/WorktreesOverviewModalViewModel.cs

@@ -12,7 +12,7 @@ using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
 
 namespace ClaudeDo.Ui.ViewModels.Modals;
 
-public enum BatchMergeOutcome { None, Merging, Merged, Conflict, Blocked, Failed }
+public enum BatchMergeOutcome { None, Merging, Merged, Conflict, Blocked, VerifyFailed, Failed }
 
 public sealed partial class WorktreeOverviewRowViewModel : ViewModelBase
 {
@@ -402,6 +402,14 @@ public sealed partial class WorktreesOverviewModalViewModel : ViewModelBase
                     case "blocked":
                         row.MergeOutcome = BatchMergeOutcome.Blocked;
                         break;
+                    case "verify_failed":
+                        // The merge landed (so the worktree really is merged), but the list's
+                        // verify command failed and the task was kept out of Done. Reporting
+                        // this as a plain Failed would claim the merge didn't happen.
+                        row.MergeOutcome = BatchMergeOutcome.VerifyFailed;
+                        row.State = WorktreeState.Merged;
+                        row.IsChecked = false;
+                        break;
                     default:
                         row.MergeOutcome = BatchMergeOutcome.Failed;
                         break;

src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs

@@ -529,13 +529,30 @@ public sealed class TaskMergeService
     public async Task<MergeResult> ApproveAndMergeAsync(
         string taskId, string targetBranch, bool leaveConflictsInTree, CancellationToken ct)
     {
-        var (task, list, wt, _) = await LoadMergeContextAsync(taskId, ct);
+        var (task, list, wt, verifyCommand) = await LoadMergeContextAsync(taskId, ct);
 
         if (task.Status != TaskStatus.WaitingForReview)
             return Blocked("task is not waiting for review");
 
         if (wt is null || wt.State != WorktreeState.Active)
         {
+            // There is nothing left to merge -- a sandbox run, or a list-handler task that
+            // committed straight into the list's working dir. The verify command still has to
+            // pass before the task may reach Done: skipping it here would exempt exactly the
+            // runs that land the most on the target branch at once. Same working dir and same
+            // per-repo gate as the merge path, so a concurrent merge can't land mid-verify.
+            if (!string.IsNullOrWhiteSpace(verifyCommand) && !string.IsNullOrWhiteSpace(list.WorkingDir))
+            {
+                var verifyGate = GetMergeGate(list.WorkingDir!);
+                await verifyGate.WaitAsync(ct);
+                try
+                {
+                    var failed = await RunVerifyGateAsync(verifyCommand, list.WorkingDir!, ct);
+                    if (failed is not null) return failed;
+                }
+                finally { verifyGate.Release(); }
+            }
+
             var done = await _state.ApproveReviewAsync(taskId, ct);
             return done.Ok
                 ? new MergeResult(StatusMerged, Array.Empty<string>(), null)