fix(worker): route FinalizeParentDoneAsync through TaskStateService

Replaces the direct EF Status write in PlanningMergeOrchestrator with
_state.ApproveReviewAsync, enforcing the TaskStateService invariant as
sole owner of Status writes. Handles the improvement-parent path where
TaskMergeService already approved the parent's own worktree during the
drain (status == Done on entry → still success). If the parent was
concurrently cancelled, the transition guard rejects the approve,
PlanningCompleted is not broadcast, and the cancelled status is
preserved. ApproveReviewAsync now also sets FinishedAt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/ClaudeDo.Worker/State/TaskStateService.cs

@@ -126,11 +126,14 @@ public sealed class TaskStateService : ITaskStateService
 
     public async Task<TransitionResult> ApproveReviewAsync(string taskId, CancellationToken ct)
     {
+        var now = DateTime.UtcNow;
         await using (var ctx = await _dbFactory.CreateDbContextAsync(ct))
         {
             var affected = await ctx.Tasks
                 .Where(t => t.Id == taskId && t.Status == TaskStatus.WaitingForReview)
-                .ExecuteUpdateAsync(s => s.SetProperty(t => t.Status, TaskStatus.Done), ct);
+                .ExecuteUpdateAsync(s => s
+                    .SetProperty(t => t.Status, TaskStatus.Done)
+                    .SetProperty(t => t.FinishedAt, now), ct);
 
             if (affected == 0)
                 return new TransitionResult(false, "Task is not waiting for review; cannot approve.");