delivery-kid: webhook writes finalized state to ReleaseDraft wiki YAML

[magent-cryptograss]

Why

#95 closed half the gap — `_update_draft_finalize` now writes `status=finalized` + `final_cid` into delivery-kid's `draft.json` when the Coconut webhook arrives. But the wiki `ReleaseDraft:{id}` page YAML stays on the pre-finalize state because the historical "write the YAML edit" step was done by browser-side JS responding to an SSE `complete` event that the slow Coconut path never sends.

The Blue Railroad Imports bot's `find_cid_from_history` greps wiki edit summaries for "Finalized: pinned to IPFS as " to know which drafts to promote. With no such edit ever being made for V2-Coconut finalizes, no Release page ever appears, even though the HLS has been pinned end-to-end.

What

Three connected changes:

1. New `pickipedia_client.write_finalized_to_releasedraft` — loads the current ReleaseDraft YAML, sets the three finalized-state fields (`status`, `final_cid`, `finalized_at`), saves with the bot-trigger summary. Preserves all user-supplied YAML fields by parse+update+dump rather than rewriting.

2. `_update_draft_finalize` fires the wiki write as an asyncio task right after the existing draft.json update and diagnostics snapshot. Same fire-and-forget pattern as the snapshot — wiki blips don't mask the underlying finalize outcome.

3. Stage-by-stage `finalize_log` entries so the wiki diagnostics panel narrates the webhook-side work instead of jumping straight from "transcoding-submitted" to "complete". All entries land in a single `draft.json` save (we don't have a stream back to the browser; the panel picks them up on its next poll).

Also: PyYAML added to requirements.txt — not used elsewhere in pinning-service, so wasn't guaranteed installed.

Test plan

• Deploy delivery-kid with `--rebuild` (new PyYAML dep needs to be baked into the image)
• Re-finalize the terrapin draft
• Watch `docker logs pinning-service`: expect `pickipedia_client: marked ReleaseDraft:{id} finalized` after the Coconut webhook
• Wiki page revision history should show a "Finalized: pinned to IPFS as Qm..." edit by Magent@magent
• On the next Blue Railroad Imports cron run, `Release:{hls_cid}` appears
• New Release page resolves to a directory with `master.m3u8` + variant playlists + segments — real playable video, not a 421-byte `metadata.json` again

Known followups (not in this PR)

• Coconut V2 quality variants (`mp4:480p`, `mp4:720p` style) — current finalize uses Coconut V2 defaults
• Trim (V2 syntax to be discovered)
• The modal UI on the wiki page still flashes through stages because it's SSE-driven and the SSE closes early. Real fix would be longer-lived SSE that monitors the webhook. The diagnostics panel (poll-based) does narrate progress correctly after this PR; the modal is the same UX gap as before.