Fail closed on malformed Claude final results

[glittercowboy]

TL;DR

• treat malformed Claude final result payloads as terminal errors instead of fabricated success
• add daemon coverage for the malformed-result path and a fake-claude switch to reproduce it
• this restores trustworthy terminal task semantics before the cloud replay/durability changes land

Why this matters

• the session actor previously ignored JSON unmarshal failure for the final Claude result payload
• a truncated or malformed payload could still emit TaskComplete with zero-value usage data
• that corrupts task outcome, usage metrics, and any downstream UI that assumes the run truly completed

How it works now

• handleResult fails closed when final result JSON cannot be parsed
• the actor logs the parse failure with payload context and returns an error so the run emits TaskError
• cmd/fake-claude can now emit an invalid final result via FAKE_CLAUDE_INVALID_RESULT=1 for regression coverage

Verification

• go test ./internal/session

Post-merge action

• merge this repo before the paired cloud-app durability PR
• push the next daemon/vX.Y.Z tag after merge so release-daemon.yml publishes updated binaries
• verify the release workflow completes and the expected artifacts are present before calling the workstream shipped