A single gate command that defines success
The agent writes the complete candidate and then runs one `finalize` command. That command chains validation, delivery, a strict check and a real-browser check. The agent doesn't run a pre-validation pass of its own, and it may not count a failed exit as done. With one gate there is one clear finish line, which cuts out redundant steps and false claims of success.