The change itself is already on main via PR #217, but its tasks checklist still
looked incomplete. This follow-up updates the change artifact so the recorded
state matches the merged PR, cleaned worktree/ref state, and post-merge
verification that was rerun on main.

Constraint: Keep the follow-up limited to the existing change artifact; do not reopen the behavioral change itself
Rejected: Leave the tasks checklist stale after merge | it conflicts with the repo's OpenSpec completion contract
Confidence: high
Scope-risk: narrow
Directive: When a guarded finish flow merges a change before the artifact checklist is updated, add a tiny follow-up rather than leaving completion evidence implicit
Tested: openspec validate agent-codex-setup-protected-main-sandbox-2026-04-21-12-02 --type change --strict; git diff --check
Not-tested: Full npm test (no code changed in this follow-up)