Fix external completion outside Git worktrees

[areshand]

Summary

• separate source-diff completion checks from external-operation closure checks
• keep normal source completion fail-closed on the canonical Git diff
• allow external-only workflows to complete outside Git while retaining verifier, finding, and TODO closure checks
• add a lifecycle regression for enforced external-only completion with a successful terminal receipt and a non-Git root

Production finding

The GitHub E2E completed four independently reviewed github.read operations through prod-mcp and found aptos-core PR #20446 with an empty submitted-review list. Final workflow completion then failed because the shared source completion checker invoked git diff from the session control working directory, which is intentionally not a Git worktree.

Validation

• rustup run 1.98.0 cargo fmt --check
• rustup run 1.98.0 cargo test --workspace --all-targets (59 passed)
• rustup run 1.98.0 cargo build
• npm test --prefix control-server (8 passed)
• tests/run.sh
• tests/mock_orchestration_e2e.sh
• git diff --check