feat: engagement close-session wires vault, metrics, Kai ledger (WP-0009 T09)

Add close_session helpers and CLI to append vault session logs, engagement-
scoped metrics, duty Kai charges, and client reports. Rejects sensitive
summaries. Pilot smoke-closed once; prepare points operators at close-session.

CHANGELOG.md

@@ -12,9 +12,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `keepaTodofile` agent remains available for other projects
 
 ### Added
-- **`engagement` CLI (WP-0009 T08)** — forward-deployed engagement lifecycle:
+- **`engagement` CLI (WP-0009 T08–T09)** — forward-deployed engagement lifecycle:
   `list`/`show`/`validate`/`checklist`/`phase`/`prepare`/`staff`/`quote`/
-  `scrub`/`export-handoff` over file-based pilots (`engagements/pilots/`)
+  `scrub`/`export-handoff`/`close-session` over file-based pilots
+  (`engagements/pilots/`); close-session wires vault log, metrics, and Kai ledger
 - **`metrics record --emit-event`** — publishes `kaizen.metrics.recorded` NATS
   envelope for activity-core event-driven definitions (optional `nats-py` via
   `pip install 'kaizen-agentic[events]'`)