When doctor runs on protected main, sandbox auto-finish can return success while leaving the PR open due branch policy. The CLI previously labeled this as "Auto-finish flow completed", which is misleading and caused confusion. This change inspects agent-branch-finish output for pending markers, reports a pending status with PR URL, and adds a regression test for blocked merge policy behavior.

Constraint: Keep doctor exit behavior non-fatal when PR is created but merge is pending policy gates

Rejected: Force --wait-for-merge for all doctor runs | risks long hangs and timeouts on review-gated repositories

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Treat agent-branch-finish pending markers as non-complete states in higher-level status messaging

Tested: node --check bin/multiagent-safety.js

Tested: node --test test/install.test.js

Tested: npm test