fix(observability): merge-gate on deploy, full token input, Plane Done, artifact links

1. BUG 8 (second door): merge webhook no longer fake-completes a task at the
   deploy stage; done is gated by the deployer verdict (check_deploy_status).
   Other stages keep merge->done.
2. Token accounting: parse+persist cache_creation_input_tokens (new
   idempotent agent_runs column). usage_comment / task_summary now show the
   FULL input (input + cache_read + cache_creation) with a cached breakdown.
   cost_usd untouched.
3. deploy->done success now forces the Plane issue to terminal Done state.
4. All agents (architect/developer/reviewer/tester/deployer) attach artifact
   links to their finish comment via gitea_public_url.

Tests added for each fix; pytest 244 passed / 9 failed (off-limits HMAC group).

src/plane_sync.py

@@ -343,6 +343,17 @@ def set_issue_blocked(work_item_id: str, project_id: str = None):
     _set_issue_state_direct(work_item_id, PLANE_STATES["blocked"], project_id)
 
 
+def set_issue_done(work_item_id: str, project_id: str = None):
+    """Observability fix: force the issue into the TERMINAL Done state.
+
+    Used by the deploy->done success path so a completed task always reaches the
+    terminal Plane state (it used to stick on In Progress because the merge
+    webhook bypassed the stage engine). Uses the existing PLANE_STATES['done']
+    UUID — the mapping itself is NOT changed.
+    """
+    _set_issue_state_direct(work_item_id, PLANE_STATES["done"], project_id)
+
+
 def set_issue_in_progress(work_item_id: str, project_id: str = None):
     """Set issue to 'In Progress' state — agent working."""
     _set_issue_state_direct(work_item_id, PLANE_STATES["in_progress"], project_id)