feat(tasks): the hand-off — SessionEnd releases a session's claims; the practice is written down (milestone 381 step 4)

Release is the mechanical half: scribe_session_end.sh sends the ending
session's id to /api/plugin/release-session, which releases the claims it
held. A tidy-up, not the guarantee (no SessionEnd on a crash; the lease
covers that), and skipped on /clear so SessionStart(clear) can still
hand the claimed work back.

Saying what happened is the half only the model can do. It is stated as a
practice where it is read: the using-scribe skill owns it ("Hand off before
this session's context stops existing", pinned in test_guidance_ownership),
the static context points at it for the wrap-up moment, and add_task_log's
docstring says a log claims the task. _INSTRUCTIONS is untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/routes/plugin.py

@@ -388,6 +388,25 @@ async def claim_session():
     return jsonify({"claim": claim})
 
 
+@plugin_bp.get("/release-session")
+@login_required
+async def release_session():
+    """Release the claims a session held, as it ends (milestone 381 step 4).
+
+    Called by `scribe_session_end.sh`. Best-effort by design: SessionEnd does
+    not fire on a crash, so the claim's lease — not this call — is what makes a
+    dead session's claim read as dead. This only makes the common case tidy.
+
+    Query:
+        session_id (str) — the ending session's id, from the hook event.
+    """
+    session_id = (request.args.get("session_id") or "").strip()
+    if not session_id:
+        return jsonify({"error": "session_id is required"}), 400
+    released = await task_claims_svc.release_session(g.user.id, session_id)
+    return jsonify({"released": released})
+
+
 @plugin_bp.get("/processes")
 @login_required
 async def process_manifest():