fix(issue-5): keep finalize inside delegation and refresh the CLI golden

Two failures the full suite caught, both mine.

finalize.py started in lib_py/loop, which made publish_event import a sibling
package. That is the rule phase 1 wrote down and phase 2a already made me move
the engine for: under a frozen loop, delegation is bound to one tree while the
parent may be another, so reaching sideways mixes them. The manifest is written
into the job's own report directory and the CLI that declares it is a delegation
entry point, so finalize belongs there. Second time on the same rule, and the
guard caught it both times.

The publish_event --help golden no longer matched, because phase 2b
intentionally added the finalization options. The diff is exactly those three
options and nothing else, so the capture is refreshed rather than the assertion
weakened, and the test now states when a refresh is legitimate: an intended
extension, never drift nobody meant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

tests/fixtures/issue_5/phase1/help-publish_event.txt

@@ -3,7 +3,9 @@ usage: publish_event.py [-h] (--job JOB | --pick-pending)
                         [--event {started,permission_required,progress,completed,error,cancelled}]
                         [--detail DETAIL] [--data DATA] [--retained]
                         [--registry-dir REGISTRY_DIR] [--attempts ATTEMPTS]
-                        [-v]
+                        [--finalize-report PATH]
+                        [--side-effect KIND=REFERENCE]
+                        [--attempt-id ATTEMPT_ID] [-v]
 
 Publish a Job event to MQTT
 
@@ -19,4 +21,13 @@ optional arguments:
   --retained            force retain=True (auto for completed/error)
   --registry-dir REGISTRY_DIR
   --attempts ATTEMPTS
+  --finalize-report PATH
+                        atomically finalize this report and declare its
+                        completion manifest before publishing
+  --side-effect KIND=REFERENCE
+                        evidence for an external side effect this job
+                        performed
+  --attempt-id ATTEMPT_ID
+                        attempt this finalization belongs to (default: the
+                        job's current iteration)
   -v, --verbose