fix: make workflow status and close agree on readiness

[voku]

Evidence

Real integration: voku/httpful#34, docs/agents/agent-loop-findings.md finding C6.

The run reached a state where workflow status reported ready_to_close, but workflow close --status done refused the transition because current Contract validation evidence was missing/not passed.

This is reproducible from current main's rules:

• RunManifestProjector::verificationReference() reports pending_close before a durable verification receipt exists.
• RunManifestProjector::overallState() only handles failed, passed, and accepted_risk, then falls through to ready_to_close for pending_close.
• WorkflowCloseCommand::validationSnapshot() independently checks every current Contract validation obligation and runGates() blocks missing/not-passed evidence.

Problem

The read model and transition command answer the same question with different predicates. ready_to_close therefore cannot be trusted as an actionable state.

Narrow goal

Make ready_to_close mean that running close now is expected to pass the read-only gates, barring a concurrent implementation change.

Acceptance criteria

• Failed, missing, stale, or not-current Contract validation evidence can never project ready_to_close.
• workflow status reports the blocking reason/action instead of merely pointing at workflow close.
• The close transition keeps authority over mutations, accepted-risk recording, receipt writing, and Session closure.
• The read-only readiness decision is shared/reused where practical instead of maintaining another copy of close-gate semantics.
• Regression test: status on the httpful failure shape is non-ready and the reason corresponds to the close failure.
• Regression test: after all read-only close gates are satisfied, status is ready_to_close; after successful close it is complete.

Non-goal

Do not weaken close gates to make the projection true. The projection must become as strict as the transition, not the other way around.