Devin: recover structured completion across waiting and merge boundaries

[jeffhuber]

Part of #901. Follow-up to #906, #907, and #908.

Problem

A hosted Devin session can return a valid code_mower.builderCompletion.v1 object while the v3 session remains running with status_detail=waiting_for_user. The release-campaign adapter recognizes this as complete, but the provider-neutral remote lifecycle reports waiting_for_user, so collect cannot persist or verify the result.

PR #932 also demonstrated a crash/reordering boundary: the PR merged shortly before the structured completion arrived. The current verifier accepts only an open PR, so safe recovery after merge cannot produce verified_pr even when the repository, closing issue, builder identity, branch, base, and exact head all still match. Closed-unmerged PRs must remain rejected.

Scope

1. Make provider-neutral Devin lifecycle normalization treat a valid builder-completion object as complete when raw status is otherwise waiting_for_user.
2. Preserve the approval boundary: waiting_for_approval must remain owner action even if a structured object is present.
3. Permit retrospective builder verification of a merged PR only when every existing repository, issue, numeric author ID/login, head repository/branch/SHA, and base binding matches exactly.
4. Continue rejecting closed-unmerged PRs, changed heads, unrelated issues, ambiguous candidates, and malformed or mismatched completion objects.
5. Keep public projections metadata-only and private structured output in the protected local artifact.

Acceptance criteria

• Regression fixture matching Devin: deliver authorized context packets to Devin roles and hosted builder input #932 (running + waiting_for_user + valid round completion) normalizes to complete and can be collected.
• waiting_for_approval still blocks collection even with structured output.
• Recovery immediately before merge verifies an open exact-bound PR.
• Recovery immediately after merge verifies the same exact-bound merged PR.
• Closed-unmerged and every existing repository/issue/author/branch/base/head mismatch remain rejected.
• No create, message, termination, archive, or duplicate paid request is needed for recovery.
• Focused Devin lifecycle/work-order tests, full relevant suite, privacy checks, normal CI, and code-mower/gate pass.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record Code Mower Codex as the named builder, keep one writer on the branch, obtain an independent Code Mower Claude review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Do not merge until exact-head evidence is reported. Keep all public and cloud evidence metadata-only: never include credentials, prompts, messages, transcripts, private context, raw structured output, source, or diffs.