…cate finalReadinessCheck, add session fallback for complete_step command matching, and drop stale todo indicator (esengine#3587)

Three changes that all reduce false signals in the evidence/complete_step/todo
verification system:

1. Remove duplicate complete_step ordering check from finalReadinessCheck.
   The todo_write tool's own guard (verifyTodoCompletionTransitions) already
   rejects marking items completed without a matching complete_step receipt,
   and is order-independent. The finalReadinessCheck duplicate was stricter
   (required complete_step after the latest writer), causing false positives
   when the model correctly completes steps in a different order.

2. Add session-fallback command verification in complete_step.
   The per-turn Ledger is reset each turn, so cross-turn references, non-bash
   tool calls (e.g. the `ls` tool cited as command="ls ."), and truncated
   command strings all fail the strict receipt match. verifyCommandFromSession
   scans the full conversation transcript with normalized matching (strip …,
   collapse whitespace, prefix match with 8-char minimum) and tool-name
   fallback, eliminating three common false negatives.

3. Remove stale "Progress may be stale" indicator from desktop TodoPanel.
   The heuristic (≥2 tools after last todo_write, final assistant message,
   readiness notices) triggered false alerts in normal completion flows.
   The todo count and transcript itself provide better progress visibility.

Fixes esengine#3469

Co-authored-by: wufengfan <wufengfan@wufengfandeMacBook-Air.local>

…ommand-string drift (#3982)

* fix(evidence): match paraphrased verification commands and guide complete_step self-correction

complete_step rejected real verifications whenever the cited command string
was not byte-identical to the bash receipt: a dropped cd prefix (#2917), a
flag or quote-style drift, or a piped tail all failed both the ledger match
and the #3587 session fallback's prefix matching. Local session forensics
show 5 of 18 real complete_step calls rejected this way, each cascading into
todo_write failures and final answers that overclaim.

Match commands by shell segment instead: split cited and ran commands on
&&/||/;/|/newlines, quote-strip and whitespace-normalize tokens, and accept a
cited segment when a ran segment equals it or supersets its tokens under the
same head token. One-token citations still require exact equality, and an
aggregated citation that no single command covers is still rejected. The
session fallback now uses the same matcher and skips calls whose recorded
result is an error or block, closing the false positive where any attempted
command counted as proof.

Rejections now carry recovery context: ran-but-nonzero commands are
distinguished from never-ran (with a '|| true' hint for negative
verification, e.g. proving a file is gone), never-ran rejections list the
turn's actual receipts, and the schema marks command/paths as required for
their kinds instead of advertising them optional.

* fix(evidence): count bash commands naming a path as files receipts

Files created or edited through shell redirection (seq … > file, sed -i)
leave no reader/writer receipt, so files evidence for them was always
rejected and the model had to re-write the file with write_file just to
mint a receipt. A successful bash command whose text names the path now
counts as having touched it.

---------

Co-authored-by: reasonix <reasonix@deepseek.com>

Per-turn evidence ledger reset made complete_step reject cross-turn citations and let the final gate miss an unfinished plan. diff/files evidence now falls back to the full session (like commands, #3587); the host keeps a canonical todo list (survives turns + compaction) the gate consults; a successful complete_step advances that list so the model no longer batches todo_write (#3909). Real-API A/B confirmed base rejects/blocks where the PR accepts/advances.

Closes #2917