fix(worker): route done-toggle and dequeue through guarded TaskStateService transitions

The task-list done toggle (both islands) and RemoveFromQueue wrote TaskEntity.Status
directly via EF, bypassing TaskStateService: no TaskUpdated broadcast, no guard against
a concurrent picker claim (lost update), and no status-based filter. Added guarded
MarkDoneAsync/UnmarkDoneAsync/DequeueToIdleAsync transitions plus matching hub methods
(SetTaskDone/UnsetTaskDone/DequeueTask) and IWorkerClient wrappers; the three UI call
sites now route through the hub with optimistic-then-revert row updates and
ErrorReported on failure. RemoveFromQueueAsync dequeues each queued child individually
through the same guarded path instead of cascading via a raw EF update.

Also closes two hub guard gaps: UpdateListConfig's delete branch now preserves a list's
SerializeOnFileOverlap flag instead of dropping it, and SubmitTaskForReview's Idle/Failed
status gate now runs before either mutation branch so a Done/Cancelled task can't get
committed or stamped and then rejected.

src/ClaudeDo.Worker/State/TaskStateService.cs

@@ -379,6 +379,52 @@ public sealed class TaskStateService : ITaskStateService
         return new TransitionResult(true, null);
     }
 
+    public async Task<TransitionResult> MarkDoneAsync(string taskId, DateTime finishedAt, CancellationToken ct)
+    {
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        var affected = await ctx.Tasks
+            .Where(t => t.Id == taskId && t.Status == TaskStatus.Idle)
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(t => t.Status, TaskStatus.Done)
+                .SetProperty(t => t.FinishedAt, finishedAt), ct);
+
+        if (affected == 0)
+            return new TransitionResult(false, "Task is not Idle; cannot mark done.");
+
+        await _broadcaster.TaskUpdated(taskId);
+        return new TransitionResult(true, null);
+    }
+
+    public async Task<TransitionResult> UnmarkDoneAsync(string taskId, CancellationToken ct)
+    {
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        var affected = await ctx.Tasks
+            .Where(t => t.Id == taskId && t.Status == TaskStatus.Done)
+            .ExecuteUpdateAsync(s => s.SetProperty(t => t.Status, TaskStatus.Idle), ct);
+
+        if (affected == 0)
+            return new TransitionResult(false, "Task is not Done; cannot unmark.");
+
+        await _broadcaster.TaskUpdated(taskId);
+        return new TransitionResult(true, null);
+    }
+
+    public async Task<TransitionResult> DequeueToIdleAsync(string taskId, CancellationToken ct)
+    {
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        var affected = await ctx.Tasks
+            .Where(t => t.Id == taskId && t.Status == TaskStatus.Queued)
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(t => t.Status, TaskStatus.Idle)
+                .SetProperty(t => t.BlockedByTaskId, (string?)null), ct);
+
+        if (affected == 0)
+            return new TransitionResult(false, "Task is not queued; cannot remove from queue.");
+
+        await _broadcaster.TaskUpdated(taskId);
+        return new TransitionResult(true, null);
+    }
+
     public async Task<TransitionResult> StartPlanningAsync(string parentId, CancellationToken ct)
     {
         await using var ctx = await _dbFactory.CreateDbContextAsync(ct);