fix(observability): merge-gate on deploy, full token input, Plane Done, artifact links

1. BUG 8 (second door): merge webhook no longer fake-completes a task at the
   deploy stage; done is gated by the deployer verdict (check_deploy_status).
   Other stages keep merge->done.
2. Token accounting: parse+persist cache_creation_input_tokens (new
   idempotent agent_runs column). usage_comment / task_summary now show the
   FULL input (input + cache_read + cache_creation) with a cached breakdown.
   cost_usd untouched.
3. deploy->done success now forces the Plane issue to terminal Done state.
4. All agents (architect/developer/reviewer/tester/deployer) attach artifact
   links to their finish comment via gitea_public_url.

Tests added for each fix; pytest 244 passed / 9 failed (off-limits HMAC group).

src/agents/launcher.py

@@ -699,12 +699,49 @@ class AgentLauncher:
         task_id, work_item_id = row[0], row[1]
         if not work_item_id:
             return
-        plane_add_comment(work_item_id, usage_comment(agent, usage), author=agent)
+        # Observability: every agent's finish comment links its artifact(s)
+        # (reviewer->12-review, tester->13-test-report, deployer->14-deploy-log,
+        # architect->ADR, developer->PR/branch). For the developer we resolve the
+        # open PR number so the link points straight at it.
+        pr_number = None
+        if agent == "developer":
+            pr_number = self._open_pr_number(repo, branch)
+        plane_add_comment(
+            work_item_id,
+            usage_comment(
+                agent,
+                usage,
+                repo=repo,
+                branch=branch,
+                work_item_id=work_item_id,
+                pr_number=pr_number,
+            ),
+            author=agent,
+        )
         if agent == "deployer":
             plane_add_comment(
                 work_item_id, task_summary_comment(task_id), author="deployer"
             )
 
+    def _open_pr_number(self, repo: str, branch: str):
+        """Return the open PR number for `branch`, or None. Never raises."""
+        try:
+            import httpx
+            owner = settings.gitea_owner
+            headers = {"Authorization": f"token {settings.gitea_token}"}
+            resp = httpx.get(
+                f"{settings.gitea_url}/api/v1/repos/{owner}/{repo}/pulls",
+                params={"state": "open", "head": branch},
+                headers=headers, timeout=5,
+            )
+            if resp.status_code == 200:
+                prs = resp.json()
+                if prs:
+                    return prs[0].get("number")
+        except Exception:
+            pass
+        return None
+
     def _ensure_pr(self, repo: str, branch: str, run_id: int):
         import httpx
         owner = settings.gitea_owner