Fixes #2917

Summary

• gate final-answer readiness on the latest successful todo_write list, even in pure bash/todo flows with no writer receipt
• keep final answers blocked until the latest successful todo list has no pending or in_progress items
• make CLI and Desktop todo panels advance only from successful todo_write results, so failed attempts do not become canonical UI state

Validation

• D:\Go\go\bin\go.exe test ./internal/agent -run "TestFinalReadinessFailureBranches"
• D:\Go\go\bin\go.exe test ./internal/cli -run "TestTodoPanelKeepsLastSuccessfulTodoWrite"
• D:\Go\go\bin\go.exe test ./internal/agent
• D:\Go\go\bin\go.exe test ./internal/evidence
• D:\Go\go\bin\go.exe test ./internal/cli
• D:\Go\go\bin\go.exe test ./...
• pnpm --dir desktop/frontend typecheck
• pnpm --dir desktop/frontend build
• git diff --check

No screenshot is attached because the UI layout and styling are unchanged; the change is state acceptance behavior for todo_write results.