fix(worker): route FinalizeParentDoneAsync through TaskStateService

Replaces the direct EF Status write in PlanningMergeOrchestrator with
_state.ApproveReviewAsync, enforcing the TaskStateService invariant as
sole owner of Status writes. Handles the improvement-parent path where
TaskMergeService already approved the parent's own worktree during the
drain (status == Done on entry → still success). If the parent was
concurrently cancelled, the transition guard rejects the approve,
PlanningCompleted is not broadcast, and the cancelled status is
preserved. ApproveReviewAsync now also sets FinishedAt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/ClaudeDo.Worker.Tests/Planning/TreeMergeTests.cs

@@ -126,15 +126,17 @@ public sealed class TreeMergeTests : IDisposable
         var broadcaster = new HubBroadcaster(fakeHub);
         var git = new GitService();
         var factory = db.CreateFactory();
+        var built = TaskStateServiceBuilder.Build(factory);
         var merge = new TaskMergeService(
             factory, git, broadcaster,
-            TaskStateServiceBuilder.Build(factory).State,
+            built.State,
             NullLogger<TaskMergeService>.Instance);
         var aggregator = new PlanningAggregator(
             factory, git,
             NullLogger<PlanningAggregator>.Instance);
         var orch = new PlanningMergeOrchestrator(
             factory, merge, aggregator, broadcaster, git,
+            built.State,
             NullLogger<PlanningMergeOrchestrator>.Instance);
         return (orch, spy.Calls);
     }