fix: copy deliverables to audit-logs once at workflow end instead of per-agent

Moves the copyDeliverablesToAudit call from runAgentActivity (called after
every agent) to logWorkflowComplete (called once at workflow end). This
prevents intermediate agent runs from copying incomplete or rogue deliverables
into the audit trail.

src/temporal/activities.ts

@@ -258,13 +258,6 @@ async function runAgentActivity(
     });
     await commitGitSuccess(repoPath, agentName);
 
-    // 9.5. Copy deliverables to audit-logs (non-fatal)
-    try {
-      await copyDeliverablesToAudit(sessionMetadata, repoPath);
-    } catch (copyErr) {
-      console.error(`Failed to copy deliverables to audit-logs for ${agentName}:`, copyErr);
-    }
-
     // 10. Return metrics
     return {
       durationMs: Date.now() - startTime,
@@ -717,4 +710,11 @@ export async function logWorkflowComplete(
   await auditSession.initialize(workflowId);
   await auditSession.updateSessionStatus(summary.status);
   await auditSession.logWorkflowComplete(summary);
+
+  // Copy all deliverables to audit-logs once at workflow end (non-fatal)
+  try {
+    await copyDeliverablesToAudit(sessionMetadata, repoPath);
+  } catch (copyErr) {
+    console.error('Failed to copy deliverables to audit-logs:', copyErr);
+  }
 }