feat: engagement close-session wires vault, metrics, Kai ledger (WP-0009 T09)

Add close_session helpers and CLI to append vault session logs, engagement-
scoped metrics, duty Kai charges, and client reports. Rejects sensitive
summaries. Pilot smoke-closed once; prepare points operators at close-session.

workplans/kaizen-agentic-WP-0009-forward-deployed-agency.md

@@ -39,7 +39,7 @@ tasks:
     status: done
     title: CLI engagement command group (request, staff, prepare, checklist, scrub)
   - id: T09
-    status: todo
+    status: done
     title: Wire prepare/session-close to vault paths, metrics, and ledger entries
   - id: T10
     status: todo
@@ -202,14 +202,15 @@ Tests: `tests/test_engagement_cli.py`. Docs: CLI cheat sheet section.
 
 ```task
 id: KAIZEN-WP-0009-T09
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "82ac0b5a-0309-4912-93bf-f05bee2abbc2"
 ```
 
-- `engagement prepare` bundles definition + vault + protocols + access plan
-- Session close path updates vault, `metrics record`, optional Kai duty charge
-- No secrets in prepare output or ledger
+**Delivered:** `engagement close-session` wires vault session log, engagement-scoped
+metrics (`.kaizen/metrics/` under the pilot tree), Kai `ledger.jsonl` duty charge,
+and `reports/` stub. Rejects sensitive summaries. `prepare` session-close section
+points at close-session. Tests cover formula, scrub, and CLI.
 
 ## railiance01 pilot through ramp-up