feat: merge-report lease proof fields and handoff audit (#535)

Surface lease_proof_source / recovery reason from sanctioned session
provenance on gitea_merge_pr results, and block final reports that claim
manual/seeded/injected lease proof without MCP adoption evidence.

Closes #535

gitea_mcp_server.py

@@ -4367,6 +4367,13 @@ def gitea_merge_pr(
         live_head_sha=result.get("head_sha"),
         pinned_head_sha=expected_head_sha,
     ))
+    # Always surface how the in-session lease was established (#535), even when
+    # the lease gate blocks (e.g. unsanctioned manual _SESSION_LEASE seed).
+    result.update(
+        merger_lease_adoption.describe_session_lease_proof(
+            reviewer_pr_lease.get_session_lease()
+        )
+    )
     if reasons:
         return result
 
@@ -4524,6 +4531,12 @@ def gitea_merge_pr(
 
     result["performed"] = True
     result["merge_result"] = f"PR #{pr_number} merged via '{do}'."
+    # Re-attach after success in case session lease was heartbeated mid-path.
+    result.update(
+        merger_lease_adoption.describe_session_lease_proof(
+            reviewer_pr_lease.get_session_lease()
+        )
+    )
     reasons.append(f"all gates passed; merged PR #{pr_number} via '{do}'")
     return result