feat(worker): PowerUse-Addendum an die Handler-Prompts, Cap aus den Settings

HandoffRoundTracker.Register nimmt den Cap jetzt als Parameter statt aus einer
Konstante; HandoffMcpTools liest ihn pro Aufruf aus app_settings. Werte unter 1
werden auf 1 geklemmt (in WorkerHub UND in Register): der Cap ist das Einzige,
was eine entlaufene Handoff-Kette begrenzt, "0 = unbegrenzt" darf kein Aufrufer
waehlen koennen.

InteractiveLaunchSpecService.ComposeHandlerPromptAsync haengt das PowerUse-
Addendum an den Phasen-Prompt, aber nur wenn globaler Schalter und Listen-Opt-in
beide gesetzt sind. Bewusst ein Addendum statt einer zweiten Prompt-Garnitur:
die gemeinsamen 95% bleiben an einer Stelle, und ein Run ohne PowerUse bekommt
einen byte-identischen Prompt wie vorher. Das Addendum ist als Override der
interaktiven Regeln formuliert (nie fragen, entscheiden und protokollieren;
Konflikte loesen oder abbrechen, nie im Tree liegen lassen; Arbeit ernten, wenn
eine Runde sonst leer laeuft).

Drei Tests pinnen alle vier Ecken des UND, weil die Sicherheitsaussage des
Features genau daran haengt.

tests/ClaudeDo.Worker.Tests/External/HandoffMcpToolsTests.cs

@@ -4,6 +4,7 @@ using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.External;
 using ClaudeDo.Worker.Hub;
 using ClaudeDo.Worker.Tests.Infrastructure;
+using Microsoft.EntityFrameworkCore;
 using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
 
 namespace ClaudeDo.Worker.Tests.External;
@@ -26,7 +27,17 @@ public sealed class HandoffMcpToolsTests : IDisposable
     public void Dispose() { _ctx.Dispose(); _db.Dispose(); }
 
     private HandoffMcpTools BuildSut(HandoffRoundTracker? tracker = null) =>
-        new(_tasks, new HubBroadcaster(_hubContext), tracker ?? new HandoffRoundTracker());
+        new(_tasks, new HubBroadcaster(_hubContext), tracker ?? new HandoffRoundTracker(), _db.CreateFactory());
+
+    /// The cap the SUT reads comes from app_settings, so a test that wants a different cap has to
+    /// write it there. GetAsync is AsNoTracking, hence the separate tracked query.
+    private async Task SetMaxHandoffsAsync(int value)
+    {
+        await new AppSettingsRepository(_ctx).GetAsync();
+        var row = await _ctx.AppSettings.FirstAsync(s => s.Id == AppSettingsEntity.SingletonId);
+        row.ListHandlerMaxHandoffs = value;
+        await _ctx.SaveChangesAsync();
+    }
 
     private async Task<TaskEntity> SeedTaskAsync(string listId, TaskStatus status = TaskStatus.Idle, string title = "t")
     {
@@ -198,6 +209,55 @@ public sealed class HandoffMcpToolsTests : IDisposable
             secondSut.HandoffListHandler(handlerTask.Id, survivors, "wait", CancellationToken.None));
     }
 
+    [Fact]
+    public async Task HandoffListHandler_RaisedCapSetting_AllowsMoreRoundsBeforeCoercing()
+    {
+        await SetMaxHandoffsAsync(8);
+
+        var listId = await SeedListAsync();
+        var handlerTask = await SeedTaskAsync(listId);
+        var survivor = await SeedTaskAsync(listId, TaskStatus.WaitingForReview, title: "Survivor");
+        var tracker = new HandoffRoundTracker();
+        var survivors = new[] { survivor.Id };
+
+        // The 5th handoff is where the default cap of 4 would coerce; with 8 configured it must not.
+        foreach (var phase in new[] { "wait", "merge", "wait", "merge", "wait", "merge", "wait", "merge" })
+        {
+            var sut = BuildSut(tracker);
+            var result = await sut.HandoffListHandler(handlerTask.Id, survivors, phase, CancellationToken.None);
+            Assert.False(result.Coerced);
+            Assert.Equal(phase, result.NextPhase);
+        }
+
+        var ninthSut = BuildSut(tracker);
+        var ninth = await ninthSut.HandoffListHandler(handlerTask.Id, survivors, "wait", CancellationToken.None);
+
+        Assert.True(ninth.Coerced);
+        Assert.Equal("wait_final", ninth.NextPhase);
+    }
+
+    [Fact]
+    public async Task HandoffListHandler_CapOfZero_IsClampedToOne_NotUnbounded()
+    {
+        // 0 must not read as "no cap" — that would remove the only bound on a runaway chain.
+        await SetMaxHandoffsAsync(0);
+
+        var listId = await SeedListAsync();
+        var handlerTask = await SeedTaskAsync(listId);
+        var survivor = await SeedTaskAsync(listId, TaskStatus.WaitingForReview, title: "Survivor");
+        var tracker = new HandoffRoundTracker();
+        var survivors = new[] { survivor.Id };
+
+        var firstSut = BuildSut(tracker);
+        var first = await firstSut.HandoffListHandler(handlerTask.Id, survivors, "wait", CancellationToken.None);
+        Assert.False(first.Coerced);
+
+        var secondSut = BuildSut(tracker);
+        var second = await secondSut.HandoffListHandler(handlerTask.Id, survivors, "merge", CancellationToken.None);
+        Assert.True(second.Coerced);
+        Assert.Equal("merge_final", second.NextPhase);
+    }
+
     [Fact]
     public async Task HandoffListHandler_TwoHandlerTasks_DoNotShareACounter()
     {