Gate agent completion on commits, pushes, and tests; capture real checkpoints

Agents could be marked done while leaving work uncommitted or unpushed:
the Stop gate only ran the test suite, and the headless supervisor's
fallback marked any still-working agent done on a clean process exit
even when the Stop gate never recorded a verdict. Checkmarks also only
ever carried hook-written boilerplate, so the webui had no real
checkpoint to show.

The Stop gate now blocks the turn on any of: failing tests, uncommitted
changes, or commits no origin/* ref contains (rev-list --not
--remotes=origin, so it works for the --no-track worktree branches).
All blockers are reported at once; status 'done' only ever accompanies
a fully passing gate. Working dirs that aren't git checkouts, and repos
without an origin remote, skip the git half so local-only projects
can't deadlock. The supervisor's clean-exit fallback now reconciles a
still-working agent to blocked instead of done — done is a gate
verdict, not an exit code (operator cancels still settle as done).

The agent's final message is captured deterministically from the
session transcript onto the checkmark's where_it_stopped, so the
dashboard always shows a real checkpoint regardless of whether the
agent thought to leave one; a blocked checkmark shows the blockers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7mF6qeryi9nJthaxYkfPm

tests/test_integration_web_spawn.py

@@ -71,13 +71,15 @@ def test_spawn_via_api_then_worker_runs_headless_claude(client, auth, headless_e
     assert got["result"]["name"] == "api"
 
     # ...and the run's whole life shows up via the API: events stream in, the agent
-    # reconciles to done, last_output is the assistant's text.
+    # reconciles, last_output is the assistant's text. The fake claude never runs the
+    # Stop gate, so the clean exit reconciles to blocked, not done — done is only ever
+    # a gate verdict (tests pass, work committed and pushed).
     def finished():
         agents = client.get("/projects/proj/agents", headers=auth).json()
-        return agents if agents and agents[0]["status"] == "done" else None
+        return agents if agents and agents[0]["status"] == "blocked" else None
 
     agents = _wait(finished)
-    assert agents is not None, "run never reconciled to done"
+    assert agents is not None, "run never reconciled"
     agent = agents[0]
     assert agent["name"] == "api"
     assert agent["session_id"]