feat(external-mcp): let set_list_config write the verify command

SetListConfig previously could only pass VerifyCommand through unchanged;
only the UI hub could set it. Add an optional verifyCommand parameter with
matching clear/merge/create-vs-delete handling, and split the list result
into ListConfigDto so the task-only SetTaskConfig/GetTaskConfig DTOs stay
untouched. Also corrects Worker/CLAUDE.md's claim that tasks can override
verify_command — it's list-only.

src/ClaudeDo.Worker/CLAUDE.md

@@ -216,7 +216,9 @@ non-obvious, behaviour-changing. A fixed bug is git history, not a finding.
 - `online_inbox` — `enabled` (false by default; when false the entire `Online/` stack is not registered), `api_base_url` (must be HTTPS or loopback, validated at startup), `poll_interval_seconds` (60), `zitadel.authority`/`client_id`/`scopes`. The refresh token is **not** in this file — DPAPI-encrypted at `~/.todo-app/online-inbox.token`.
 
 Per-list config (`list_config` in DB) provides defaults for `model`, `system_prompt`,
-`agent_path`, `max_turns`, `session_skills`, `verify_command`; tasks override each individually.
+`agent_path`, `max_turns`, `session_skills`; tasks override each individually. `verify_command` is
+list-only — there is no task-level override — and is written via `set_list_config`'s
+`verifyCommand` parameter (`ConfigMcpTools`), the only writer besides the UI's list config editor.
 
 ## Notes