feat(mcp): allow Done via update_task_status with worktree guard

External tasks finished outside a ClaudeDo run had no way to close out
their tracking task; update_task_status now permits Done alongside
Idle/Queued/Cancelled, refusing it when the task has an active
worktree so review_task stays the only path that merges.

src/ClaudeDo.Worker/State/TaskStateService.cs

@@ -329,9 +329,15 @@ public sealed class TaskStateService : ITaskStateService
     public async Task<TransitionResult> ForceSetStatusAsync(string taskId, TaskStatus status, CancellationToken ct)
     {
         await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
-        var affected = await ctx.Tasks
-            .Where(t => t.Id == taskId)
-            .ExecuteUpdateAsync(s => s.SetProperty(t => t.Status, status), ct);
+        var affected = status == TaskStatus.Done
+            ? await ctx.Tasks
+                .Where(t => t.Id == taskId)
+                .ExecuteUpdateAsync(s => s
+                    .SetProperty(t => t.Status, status)
+                    .SetProperty(t => t.FinishedAt, DateTime.UtcNow), ct)
+            : await ctx.Tasks
+                .Where(t => t.Id == taskId)
+                .ExecuteUpdateAsync(s => s.SetProperty(t => t.Status, status), ct);
 
         if (affected == 0)
             return new TransitionResult(false, "Task not found.");