fix: remove done/complete from finalization regex and coerce frontmatter scalars to strings

- Remove done and complete from isFinalization regex in runValidate so
  normal validate calls using the documented done: prefix are not blocked
  by the artifact provenance gate
- Coerce title, intent, authority_band, uri, and exposure to String in
  parseFrontmatter to prevent TypeError when fmParseScalarValue returns
  non-string types for fields that downstream code expects as strings

Author: cursoragent

workers/src/orchestrate.ts

@@ -589,7 +589,7 @@ async function runValidate(message: string, state?: OddkitState): Promise<Oddkit
 
   // Artifact provenance gate: when completion claims mention finalizing work,
   // check for session capture, change summary, and version tracking
-  const isFinalization = /\b(commit|pr|pull request|merge|ship|deploy|release|publish|finalize|complete|done|submit|deliver)\b/i.test(message);
+  const isFinalization = /\b(commit|pr|pull request|merge|ship|deploy|release|publish|finalize|submit|deliver)\b/i.test(message);
   if (isFinalization) {
     const hasJournal = /\b(journal|ledger|oldc|session|capture)/i.test(message);
     const hasChangeSummary = /\b(changelog|change\s*log|summary|what changed|release notes)/i.test(message);

workers/src/zip-baseline-fetcher.ts

@@ -256,6 +256,12 @@ function parseFrontmatter(content: string): FrontmatterResult {
 
   const result: FrontmatterResult = { ...full };
 
+  for (const key of ["title", "intent", "authority_band", "uri", "exposure"] as const) {
+    if (result[key] != null && typeof result[key] !== "string") {
+      (result as Record<string, unknown>)[key] = String(result[key]);
+    }
+  }
+
   if (typeof result.tags === "string") {
     result.tags = [result.tags];
   } else if (Array.isArray(result.tags)) {