fix(worker): harden CLI injection, stuck-Running, chain wedge, and Fail guard

1. ArgumentList (fix injection): ClaudeArgsBuilder.Build() now returns
   IReadOnlyList<string>; ClaudeProcess populates ProcessStartInfo.ArgumentList
   instead of Arguments, so values like system prompts are never shell-split.
   DailyPrepPrompt, RefinePrompt, and WeekReportService migrated similarly.
   All IClaudeProcess fakes updated.

2. ContinueAsync exception guard: wrap RunOnceAsync in try/catch matching
   the RunAsync pattern so an unexpected exception never leaves the task
   stuck in Running status.

3. Planning chain cascade: OnChildFinishedAsync now calls CancelAsync on
   the immediate blocked successor when a child fails or is cancelled,
   triggering a recursive cascade that clears the entire remaining chain
   instead of leaving it wedged.

4. FailAsync guard: restrict valid source states to Running and Queued;
   WaitingForReview -> Failed is now rejected, preventing an invalid
   transition that could corrupt the review workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/ClaudeDo.Worker.Tests/Runner/ContinueAsyncExceptionTests.cs

@@ -0,0 +1,106 @@
+using ClaudeDo.Data;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.Config;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Runner;
+using ClaudeDo.Worker.Tests.Infrastructure;
+using ClaudeDo.Worker.Tests.Services;
+using Microsoft.Extensions.Logging.Abstractions;
+using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
+
+namespace ClaudeDo.Worker.Tests.Runner;
+
+/// <summary>
+/// Verifies that ContinueAsync wraps RunOnceAsync exceptions so the task
+/// is never left stuck in Running status on an unexpected error.
+/// </summary>
+public sealed class ContinueAsyncExceptionTests : IDisposable
+{
+    private readonly DbFixture _db = new();
+    private readonly string _tempDir;
+    private readonly WorkerConfig _cfg;
+
+    public ContinueAsyncExceptionTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cd_continue_{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+        _cfg = new WorkerConfig { SandboxRoot = _tempDir, LogRoot = _tempDir };
+    }
+
+    public void Dispose() { _db.Dispose(); try { Directory.Delete(_tempDir, true); } catch { } }
+
+    private TaskRunner BuildRunner(IClaudeProcess claude, ClaudeDoDbContext ctx)
+    {
+        var dbFactory = _db.CreateFactory();
+        var broadcaster = new HubBroadcaster(new FakeHubContext());
+        var state = TaskStateServiceBuilder.Build(dbFactory).State;
+        var wt = new WorktreeManager(new ClaudeDo.Data.Git.GitService(), dbFactory, _cfg, NullLogger<WorktreeManager>.Instance);
+        return new TaskRunner(claude, dbFactory, broadcaster, wt, new ClaudeArgsBuilder(), _cfg,
+            NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry());
+    }
+
+    [Fact]
+    public async Task ContinueAsync_UnhandledException_MarksTaskFailed_NotStuckRunning()
+    {
+        var dbFactory = _db.CreateFactory();
+        string listId, taskId;
+
+        using (var ctx = _db.CreateContext())
+        {
+            listId = Guid.NewGuid().ToString();
+            ctx.Lists.Add(new ListEntity { Id = listId, Name = "L", WorkingDir = null, CreatedAt = DateTime.UtcNow });
+
+            taskId = Guid.NewGuid().ToString();
+            ctx.Tasks.Add(new TaskEntity
+            {
+                Id = taskId,
+                ListId = listId,
+                Title = "Continue me",
+                Status = TaskStatus.WaitingForReview,
+                CreatedAt = DateTime.UtcNow,
+            });
+            await ctx.SaveChangesAsync();
+
+            // A prior run with a session ID is required for ContinueAsync to proceed.
+            await new TaskRunRepository(ctx).AddAsync(new TaskRunEntity
+            {
+                Id = Guid.NewGuid().ToString(),
+                TaskId = taskId,
+                RunNumber = 1,
+                IsRetry = false,
+                Prompt = "original prompt",
+                SessionId = "sess-continue-test",
+                StartedAt = DateTime.UtcNow.AddMinutes(-5),
+                FinishedAt = DateTime.UtcNow.AddMinutes(-1),
+                ExitCode = 0,
+                ResultMarkdown = "first result",
+            });
+        }
+
+        // This process throws a non-cancellation exception to simulate an unexpected failure.
+        var throwingProcess = new ThrowingClaudeProcess(new InvalidOperationException("disk full"));
+
+        using var ctx2 = _db.CreateContext();
+        var runner = BuildRunner(throwingProcess, ctx2);
+
+        // ContinueAsync must not propagate the exception and must leave the task in Failed.
+        await runner.ContinueAsync(taskId, "please continue", "slot-1", CancellationToken.None);
+
+        using var verify = _db.CreateContext();
+        var task = await new TaskRepository(verify).GetByIdAsync(taskId);
+        Assert.NotNull(task);
+        Assert.Equal(TaskStatus.Failed, task.Status);
+    }
+
+    private sealed class ThrowingClaudeProcess : IClaudeProcess
+    {
+        private readonly Exception _ex;
+        public ThrowingClaudeProcess(Exception ex) => _ex = ex;
+
+        public Task<RunResult> RunAsync(
+            IReadOnlyList<string> arguments, string prompt, string workingDirectory,
+            Func<string, Task> onStdoutLine, CancellationToken ct)
+            => throw _ex;
+    }
+}