fix(issue-5): keep finalize inside delegation and refresh the CLI golden

Two failures the full suite caught, both mine.

finalize.py started in lib_py/loop, which made publish_event import a sibling
package. That is the rule phase 1 wrote down and phase 2a already made me move
the engine for: under a frozen loop, delegation is bound to one tree while the
parent may be another, so reaching sideways mixes them. The manifest is written
into the job's own report directory and the CLI that declares it is a delegation
entry point, so finalize belongs there. Second time on the same rule, and the
guard caught it both times.

The publish_event --help golden no longer matched, because phase 2b
intentionally added the finalization options. The diff is exactly those three
options and nothing else, so the capture is refreshed rather than the assertion
weakened, and the test now states when a refresh is legitimate: an intended
extension, never drift nobody meant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

.agents/skills/lib_py/delegation/finalize.py

@@ -11,6 +11,13 @@ Consequence, and it is the useful one: an agent that declares nothing leaves no
 manifest, a missing manifest already holds, and the explicit-event path is
 therefore preserved for unsupported agents without any special case.
 
+It lives in `lib_py.delegation`, not `lib_py.loop`, for the same reason the
+transition engine does: the artifact it writes sits in the job's own directory,
+and the CLI an agent calls to declare a finalization is a delegation entry point.
+A frozen loop can bind delegation to a different tree than the parent package, so
+delegation reaching sideways into `lib_py.loop` would mix trees -- the rule that
+caught this, twice now.
+
     writing            report-final.md.tmp is being written
     stable_candidate   the file stopped changing (a filter, never an authority)
     finalized          atomically renamed, and this manifest exists

.agents/skills/lib_py/delegation/publish_event.py

@@ -240,7 +240,7 @@ def main(argv=None) -> int:
     # written would invite exactly the partial-report adoption the contract
     # forbids. Failing here fails the publish, on purpose.
     if args.finalize_report:
-        from lib_py.loop import finalize  # local import: optional dependency of this CLI
+        from lib_py.delegation import finalize  # same package: no sibling hop (see __init__)
 
         try:
             side_effects = finalize.parse_side_effects(args.side_effects)

.agents/skills/lib_py/loop/autocomplete.py

@@ -19,7 +19,8 @@ import logging
 import os
 from typing import Any, Dict, List, Optional
 
-from lib_py.loop import finalize, policy, store
+from lib_py.delegation import finalize
+from lib_py.loop import policy, store
 
 logger = logging.getLogger("loop.autocomplete")