fix(core): commit state before finalize publishes

[kitlangton]

What

State update events now act as read barriers: a subscriber that observes a domain update event (command.updated, agent.updated, catalog.updated, ...) and immediately refetches is guaranteed to see the rebuilt state.

Fixes #37422.

Before / After

Before: State.commit ran finalize (where every domain publishes its update event) before assigning the rebuilt state:

1. A command file changes and command state rebuilds.
2. finalize publishes command.updated.
3. A subscriber receives the event and calls command.list().
4. The swap state = next has not happened yet, so the subscriber reads the old commands and never refetches again.

After: the rebuilt state is assigned first, then finalize runs. Any consumer reading on the event observes committed state.

How

• packages/core/src/state.ts — State.commit swaps state = next before invoking finalize, and the finalize doc comment now states the read-barrier contract.
• packages/core/test/state.test.ts — new test commits rebuilt state before finalize runs, written and confirmed red against the old ordering.

All seven finalize consumers were audited (agent, command, catalog, skill, websearch, integration, reference): six only publish their update event; reference rebuilds its derived materialized map and then publishes, so its event also still fires after both the swap and the rebuild. None rely on pre-commit ordering.

Scope

First slice of the config source reload plan (docs/design/config-source-reload.md on the config-source-reload branch). Deliberately excluded, coming as separate PRs:

• Domain-owned source invalidation for command/agent/plugin files inside config directories (Changes inside config directories do not trigger config-backed reloads #37429).
• Exposing config.changes and narrowing Config's rediscovery.

Testing

bun test test/state.test.ts                      # 6 pass (new test red before fix)
bun test test/{agent,command,catalog,skill,websearch,reference,integration}.test.ts \
         test/config/{agent,command}.test.ts     # 58 pass

bun typecheck in packages/core reports only pre-existing sdk-drift diagnostics also present at the base commit; none reference state.ts.

[kitlangton]

Unit checks fail with Unbound layer node: @opencode/Location in session-runner/codemode/plugin-hooks — inherited from 8db7487 (tool architecture consolidation), which introduced Tool.node -> Image.node -> Config.node -> Location.node and has been red on v2 since it landed. Verified locally at the base tip with this PR's change reverted: identical 25 failures. The state tests and all 58 State-consumer tests pass with this change.