docs(issue-5): correct the phase 2b operations note and the stale references

The important correction is an honesty one, raised independently by two
reviewers. The note claimed startup recovery runs in the subscriber. It does
not: nothing in production imports the gate or the recovery function, and there
is no per-job opt-in path, so the flag is currently a no-op in the live loop.
Phase 2b delivers a verified library and gate; wiring it in belongs to phase 3,
and the note now says so and lists what wiring requires.

Also records the checks that are now mandatory rather than caller-dependent,
that the rollback switch disables auto-completion too, that backend keys match
exactly, that bookkeeping may touch one field, that settling is conditional on
the intent actually sent, and why the intent's identity travels in the payload
rather than relying on the transport sequence.

Fixes three stale references: task.md named the pre-move path for finalize, the
loop package description still described itself as shadow-only, and a comment in
mqtt_common still pointed at the engine's original location.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

.agents/skills/lib_py/delegation/mqtt_common.py

@@ -398,7 +398,7 @@ def update_job_status(job_id: str, registry_dir: str = DEFAULT_REGISTRY_DIR,
 
     Signature, return value and exceptions are unchanged: phase 1's G-1..G-4
     assert through this function, and the shell helpers capture its effects.
-    What changed is who performs the write -- ``lib_py.loop.engine`` is now the
+    What changed is who performs the write -- ``lib_py.delegation.engine`` is now the
     only writer of job status, so the CAS rules and the audit mirror exist once
     instead of twice.