[tianxiaochannel-oss88]

Summary

• bind delegated finalization evidence to the current workflow Run/Attempt/step
• reject foreign execution actions and artifacts, non-terminal tool evidence, and mismatched output artifacts
• recompute the delegated finalization basis fingerprint at the SQLite boundary
• stabilize sidebar rail tooltip placement and disclosure E2E contracts

Verification

• contracts: 48/48
• core: 449/449
• conversation-ui-core: 36/36
• daemon: 1132/1132 (Cargo made available via /Users/tianxiao/.cargo/bin)
• Web typecheck/lint/docs: passed
• Playwright app/channel/teammates: 157/157
• packaged macOS arm64 Continuity smoke: passed
  • artifact SHA-256: ec75487341b753f7fa3dc0fed9126256af0a773fb20c51516da2b2ff0696ddfd
  • SSE disconnect/reconnect: passed
  • daemon restart and SQLite lineage: passed
  • naked-ready delegated blocker: passed
  • terminal report and completion gate: passed

Windows is intentionally out of scope for this follow-up.