feat(worker): add post-merge verification gate for list merges

Per-list optional VerifyCommand (list_config.verify_command) runs via
VerifyCommandRunner in the list's working dir right after a successful
merge/continue-merge, before the task is allowed to reach Done. A
non-zero exit or timeout leaves the merge in place but keeps the task
out of Done and reports StatusVerifyFailed with an output excerpt
through MergeResultDto/review_task; no command configured behaves
exactly as before. Merges against the same repo are now serialized
per working dir so a running verify can't be interrupted by a second
merge landing mid-build. Adds the field to the List Settings modal
(en/de localized) and covers success/failure/timeout in
TaskMergeServiceTests + VerifyCommandRunnerTests.

src/ClaudeDo.Worker/CLAUDE.md

@@ -8,7 +8,7 @@ ASP.NET Core hosted service that executes tasks via Claude CLI in isolated envir
 Worker/
   State/        — TaskStateService + TransitionResult (sole owner of Status/PlanningPhase/BlockedBy writes)
   Queue/        — IQueueWaker, IQueuePicker, QueueService (BackgroundService), OverrideSlotService, RunCancellationRegistry (taskId → running-run CTS; lets TaskStateService.CancelAsync kill the process of a cancelled task/child without a DI cycle)
-  Lifecycle/    — StaleTaskRecovery, TaskResetService, TaskMergeService, ClaudeCliPreflight, OrphanRecovery, PlanningLineageRecovery, AttachmentOrphanRecovery (startup sweep: deletes any `attachments/<taskId>/` dirs whose task no longer exists)
+  Lifecycle/    — StaleTaskRecovery, TaskResetService, TaskMergeService, VerifyCommandRunner (IVerifyCommandRunner — spawns a list's optional post-merge verify command via `cmd.exe /c`), ClaudeCliPreflight, OrphanRecovery, PlanningLineageRecovery, AttachmentOrphanRecovery (startup sweep: deletes any `attachments/<taskId>/` dirs whose task no longer exists)
   Worktrees/    — WorktreeMaintenanceService
   Agents/       — AgentFileService, DefaultAgentSeeder
   Runner/       — TaskRunner + Claude CLI integration; TaskRunMcpService/TaskRunMcpContext/TaskRunTokenRegistry (in-task MCP wired during execution)
@@ -101,7 +101,25 @@ that has children, drives `PlanningMergeOrchestrator` (merges the parent worktre
 Active + each `Done` child in order, sets the parent `Done`, and on a mid-merge
 conflict pauses for `ContinuePlanningMerge`/`AbortPlanningMerge`). Childless tasks use
 `TaskMergeService.ApproveAndMergeAsync`. There is no separate "Merge all" entry —
-approve is the single review+merge action. Review transitions live in `TaskStateService`
+approve is the single review+merge action.
+
+**Post-merge verify gate.** A list can set `ListConfigEntity.VerifyCommand` (List Settings
+modal → Verification). Null/blank (the default) = no gate, behavior is bit-identical to
+before this existed. When set, `TaskMergeService` runs it via `VerifyCommandRunner`
+(`cmd.exe /c <command>`, 10-minute fixed timeout, output tail-captured) in `list.WorkingDir`
+right after a successful `MergeNoFfAsync`/`ContinueMergeAsync` and worktree cleanup, but
+*before* the task is allowed to reach `Done`. Exit 0 → unchanged flow (worktree marked
+`Merged`, task `Done` if it was `WaitingForReview`). Non-zero exit or a timeout → the git
+merge is deliberately left in place (no auto-revert — that's a separate, unbuilt feature),
+the worktree is still marked `Merged` (it's already gone from disk when `removeWorktree`
+was requested), but the task stays out of `Done` and `MergeResult.Status` comes back
+`TaskMergeService.StatusVerifyFailed` (`"verify_failed"`) with an output excerpt in
+`ErrorMessage` — this flows through `MergeResultDto` (hub) and `ReviewTaskResult`
+(`review_task` MCP tool) unchanged, since both already treat any non-`blocked`/`conflict`
+status generically. A process-wide `ConcurrentDictionary<string, SemaphoreSlim>` keyed by
+`list.WorkingDir` serializes `MergeAsync`/`ContinueMergeAsync` (git ops + verify) per repo,
+so a verify run can't be interrupted by a second merge landing in the same working dir
+mid-build. Review transitions live in `TaskStateService`
 (`SubmitForReviewAsync`, `SubmitForChildrenAsync`, `ApproveReviewAsync`,
 `RejectToQueueAsync`, `RejectToIdleAsync`, `ClearReviewFeedbackAsync`).