Record merged completion evidence for the protected-main sandbox change (#218)

The change itself is already on main via PR #217, but its tasks checklist still
looked incomplete. This follow-up updates the change artifact so the recorded
state matches the merged PR, cleaned worktree/ref state, and post-merge
verification that was rerun on main.

Constraint: Keep the follow-up limited to the existing change artifact; do not reopen the behavioral change itself
Rejected: Leave the tasks checklist stale after merge | it conflicts with the repo's OpenSpec completion contract
Confidence: high
Scope-risk: narrow
Directive: When a guarded finish flow merges a change before the artifact checklist is updated, add a tiny follow-up rather than leaving completion evidence implicit
Tested: openspec validate agent-codex-setup-protected-main-sandbox-2026-04-21-12-02 --type change --strict; git diff --check
Not-tested: Full npm test (no code changed in this follow-up)

Co-authored-by: NagyVikt <nagy.viktordp@gmail.com>

Author: NagyVikt

openspec/changes/agent-codex-setup-protected-main-sandbox-2026-04-21-12-02/tasks.md

@@ -16,6 +16,8 @@
 
 ## 4. Completion
 
-- [ ] 4.1 Finish the agent branch via PR merge + cleanup (`gx finish --via-pr --wait-for-merge --cleanup` or `bash scripts/agent-branch-finish.sh --branch <agent-branch> --base <base-branch> --via-pr --wait-for-merge --cleanup`).
-- [ ] 4.2 Record PR URL + final `MERGED` state in the completion handoff.
-- [ ] 4.3 Confirm sandbox cleanup (`git worktree list`, `git branch -a`) or capture a `BLOCKED:` handoff if merge/cleanup is pending.
+- [x] 4.1 Finish the agent branch via PR merge + cleanup (`gx finish --via-pr --wait-for-merge --cleanup` or `bash scripts/agent-branch-finish.sh --branch <agent-branch> --base <base-branch> --via-pr --wait-for-merge --cleanup`).
+- [x] 4.2 Record PR URL + final `MERGED` state in the completion handoff.
+- [x] 4.3 Confirm sandbox cleanup (`git worktree list`, `git branch -a`) or capture a `BLOCKED:` handoff if merge/cleanup is pending.
+
+Completion note: PR #217 (`https://github.com/recodeee/gitguardex/pull/217`) reached `MERGED` on 2026-04-21T10:39:26Z. The finished worktree `agent__codex__setup-protected-main-sandbox-2026-04-21-12-02` was pruned, the merged source branch was removed locally, and the stale remote-tracking ref was cleared with `git fetch --prune origin`. Post-merge protected-main setup/install/fix verification was rerun successfully on `main`.