feat(worker): wire list-handler phase parameter through handoff chain

Threads a nextPhase parameter (wait/merge/wait_final/merge_final, validated
by the new MergeHelperPhase) from handoff_list_handler through
HubBroadcaster/WorkerHub into InteractiveLaunchSpecService, which now picks
the next session's system prompt (MergeHelperWait/MergeHelperMerge) and
model (HandlerWaitAlias/HandlerMergeAlias) from it instead of hardcoding the
old two-phase Execute prompt -- this also fixes a build break left by the
prior prompt-split task, which removed PromptKind.MergeHelperExecute without
updating its only caller.

Also sets --model/--effort/--permission-mode explicitly for every list-handler
session (Triage included) via PermissionModeResolver instead of inheriting the
CLI's ambient model and hardcoding "auto", and adds Task to the merge-helper
allowlist so the Merge phase can delegate diff reviews to subagents.

src/ClaudeDo.Worker/Runner/MergeHelperPhase.cs

@@ -0,0 +1,21 @@
+namespace ClaudeDo.Worker.Runner;
+
+/// <summary>The list handler's phase parameter, threaded from handoff_list_handler (External)
+/// through HubBroadcaster/WorkerHub down to InteractiveLaunchSpecService, which picks the next
+/// session's system prompt and model from it. Validated centrally here so an unknown value is
+/// rejected outright instead of silently falling back to a default.</summary>
+public static class MergeHelperPhase
+{
+    public const string Wait = "wait";
+    public const string Merge = "merge";
+    public const string WaitFinal = "wait_final";
+    public const string MergeFinal = "merge_final";
+
+    public static readonly IReadOnlyList<string> All = new[] { Wait, Merge, WaitFinal, MergeFinal };
+
+    public static void Validate(string phase)
+    {
+        if (!All.Contains(phase, StringComparer.Ordinal))
+            throw new ArgumentException($"Unknown list-handler phase '{phase}'. Allowed: {string.Join(", ", All)}.");
+    }
+}