Bind agent completion to verified goal receipt

[Lee-take]

What changed

• Bind Goal-backed AgentRunStatus::Completed to the exact current GoalCompletionReceipt.
• Apply the same completion guard to worker and public finish paths.
• Revalidate the receipt inside the Event Store finish transaction and reject generic raw agent_run.finished appends.
• Revalidate stored completion on restart and keep legacy Goal-less completion compatible.
• Bind completion evidence to the canonical persisted invocation and its frozen Goal revision/fingerprint.

Why

Agent run terminal state and Goal completion were separate authority paths. A frozen Goal could previously be recorded as completed without verified Goal evidence, a generic Event Store append could bypass the finish helper, and restart projection did not revalidate that authority.

Validation

• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• Goal-focused Rust tests: 33 passed
• C3D-focused Rust tests: 4 passed
• Explicit receipt-drift restart test: 1 passed
• Explicit generic finish rejection test: 1 passed
• Full sequential Rust suite: 958 passed, 0 failed, 7 ignored
• git diff --check
• Secret scan: 223 files and 5 self-tests passed; added-line high-risk scan found 0 candidates
• Exact Clippy command exited 101 on both fixed parent 83f09694 and this commit, with 422 historical diagnostics in each. Diagnostic-title and lint-category multisets have zero differences. This is a zero-new relative lint gate, not a repository-wide Clippy pass.

Scope

This PR contains only the four G0B Rust files. It does not clear historical lint debt, change versions, publish a Release, or begin Office, connector, Computer Use, resume, or Runtime refactoring work.