fix(issue-5): keep finalize inside delegation and refresh the CLI golden

Two failures the full suite caught, both mine.

finalize.py started in lib_py/loop, which made publish_event import a sibling
package. That is the rule phase 1 wrote down and phase 2a already made me move
the engine for: under a frozen loop, delegation is bound to one tree while the
parent may be another, so reaching sideways mixes them. The manifest is written
into the job's own report directory and the CLI that declares it is a delegation
entry point, so finalize belongs there. Second time on the same rule, and the
guard caught it both times.

The publish_event --help golden no longer matched, because phase 2b
intentionally added the finalization options. The diff is exactly those three
options and nothing else, so the capture is refreshed rather than the assertion
weakened, and the test now states when a refresh is legitimate: an intended
extension, never drift nobody meant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

.agents/skills/lib_py/delegation/publish_event.py

@@ -240,7 +240,7 @@ def main(argv=None) -> int:
     # written would invite exactly the partial-report adoption the contract
     # forbids. Failing here fails the publish, on purpose.
     if args.finalize_report:
-        from lib_py.loop import finalize  # local import: optional dependency of this CLI
+        from lib_py.delegation import finalize  # same package: no sibling hop (see __init__)
 
         try:
             side_effects = finalize.parse_side_effects(args.side_effects)