finalizeGate property

The FinalizeGate (gh-1412, default off): hosts set it on unattended runs (approval mode unattended/autopilot, the bench mode). When on, every run parses the task-ledger fenced block out of the final assistant answer and emits TaskLedgerEvent for the host to persist as the hidden task_ledger session record. Off = interactive behavior is byte-identical.

Mutable: only the CLI host flips this today (boot approval mode unattended); the builder's AgentWiringSpec has no knob for it in v1 — hosts that want the gate must set the field after the stack lands.