feat: engagement close-session wires vault, metrics, Kai ledger (WP-0009 T09)

Add close_session helpers and CLI to append vault session logs, engagement-
scoped metrics, duty Kai charges, and client reports. Rejects sensitive
summaries. Pilot smoke-closed once; prepare points operators at close-session.

docs/CLI_CHEAT_SHEET.md

@@ -144,6 +144,13 @@ kaizen-agentic engagement phase eng-… --to operating --force   # override grap
 kaizen-agentic engagement prepare eng-coulomb-railiance01-ho-001
 kaizen-agentic engagement prepare eng-… --format json
 
+# Session close — vault log + metrics + Kai ledger + report (no secrets)
+kaizen-agentic engagement close-session eng-coulomb-railiance01-ho-001 \
+  --success --duty standard_review \
+  --summary "daily health: watch-level disk, load OK" \
+  --time 120 --quality 0.85
+# Flags: --no-metrics --no-ledger --no-report --kai-amount N --access-class host_observe
+
 # Staff a new pilot from a Role package
 kaizen-agentic engagement staff \
   --id eng-example-001 --role host-operator \