fix(merge): apply the verify gate to worktree-less approvals and report it everywhere

ApproveAndMergeAsync short-circuits to Done whenever a task has no active
worktree -- which is exactly how a list-handler task works, since it commits
straight into the list working dir. The verify command was skipped for the run
that lands the most on the target branch at once; the loaded command was even
discarded at the destructuring. It now runs under the same per-repo gate as the
merge path before the task may reach Done.

The two merge entry points that did not know verify_failed reported it as
"Unknown status: verify_failed" (merge modal, dropping the command output) and
as a generic Failed (worktrees batch, claiming the merge never happened).

src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs

@@ -529,13 +529,30 @@ public sealed class TaskMergeService
     public async Task<MergeResult> ApproveAndMergeAsync(
         string taskId, string targetBranch, bool leaveConflictsInTree, CancellationToken ct)
     {
-        var (task, list, wt, _) = await LoadMergeContextAsync(taskId, ct);
+        var (task, list, wt, verifyCommand) = await LoadMergeContextAsync(taskId, ct);
 
         if (task.Status != TaskStatus.WaitingForReview)
             return Blocked("task is not waiting for review");
 
         if (wt is null || wt.State != WorktreeState.Active)
         {
+            // There is nothing left to merge -- a sandbox run, or a list-handler task that
+            // committed straight into the list's working dir. The verify command still has to
+            // pass before the task may reach Done: skipping it here would exempt exactly the
+            // runs that land the most on the target branch at once. Same working dir and same
+            // per-repo gate as the merge path, so a concurrent merge can't land mid-verify.
+            if (!string.IsNullOrWhiteSpace(verifyCommand) && !string.IsNullOrWhiteSpace(list.WorkingDir))
+            {
+                var verifyGate = GetMergeGate(list.WorkingDir!);
+                await verifyGate.WaitAsync(ct);
+                try
+                {
+                    var failed = await RunVerifyGateAsync(verifyCommand, list.WorkingDir!, ct);
+                    if (failed is not null) return failed;
+                }
+                finally { verifyGate.Release(); }
+            }
+
             var done = await _state.ApproveReviewAsync(taskId, ct);
             return done.Ok
                 ? new MergeResult(StatusMerged, Array.Empty<string>(), null)