fix(worker): cap the list-handler wait/merge handoff chain server-side

HandoffMcpTools.HandoffListHandler only validated the phase name and
broadcast it -- nothing bounded how many times a ConPTY session could
hand off wait<->merge, so a model that skimmed past the prompt's
"final round" line could loop indefinitely. Add HandoffRoundTracker,
an in-memory per-handler-task counter (a list-handler run always
creates a fresh handler task, so no reset logic is needed): past 4
handoffs (two full wait/merge cycles) a non-final nextPhase is
coerced to its "_final" counterpart, and any handoff after a
merge_final round for that task is rejected outright.

src/ClaudeDo.Worker/Program.cs

@@ -317,6 +317,7 @@ if (cfg.ExternalMcpPort > 0)
     externalBuilder.Services.AddScoped<RunHistoryMcpTools>();
     externalBuilder.Services.AddScoped<AgentMcpTools>();
     externalBuilder.Services.AddScoped<LifecycleMcpTools>();
+    externalBuilder.Services.AddSingleton<HandoffRoundTracker>();
     externalBuilder.Services.AddScoped<HandoffMcpTools>();
     externalBuilder.Services.AddScoped<AppSettingsMcpTools>();
     externalBuilder.Services.AddScoped<TaskWaitMcpTools>();