fix(issue-5): keep finalize inside delegation and refresh the CLI golden

Two failures the full suite caught, both mine.

finalize.py started in lib_py/loop, which made publish_event import a sibling
package. That is the rule phase 1 wrote down and phase 2a already made me move
the engine for: under a frozen loop, delegation is bound to one tree while the
parent may be another, so reaching sideways mixes them. The manifest is written
into the job's own report directory and the CLI that declares it is a delegation
entry point, so finalize belongs there. Second time on the same rule, and the
guard caught it both times.

The publish_event --help golden no longer matched, because phase 2b
intentionally added the finalization options. The diff is exactly those three
options and nothing else, so the capture is refreshed rather than the assertion
weakened, and the test now states when a refresh is legitimate: an intended
extension, never drift nobody meant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

tests/test_issue5_phase1_delegation.py

@@ -488,7 +488,13 @@ def test_importing_delegation_does_not_mutate_environment(mam_sandbox):
 
 
 def test_shim_help_output_matches_pre_move_capture():
-    """The shim must be indistinguishable from the pre-move script at the CLI."""
+    """The shim must be indistinguishable from the implementation at the CLI.
+
+    The captures were taken before the phase 1 move to prove the move changed
+    nothing. They are refreshed only when the CLI is *intentionally* extended
+    (phase 2b added the finalization options to publish_event); the guard's job
+    is to catch drift nobody meant, which it still does.
+    """
     for mod in ("publish_event", "registry", "job_subscriber"):
         golden = (FIXTURES / "help-{}.txt".format(mod)).read_text(encoding="utf-8")
         res = subprocess.run(