fix(agent): keep artifact links in deliverable cards

[iamjr15]

Why

Production spreadsheet QA exposed contradictory completion guidance: the agent was told both to provide a working link and to rely on the generated Deliverable card. That caused it to invent a Markdown link that rendered as [blocked] even though the workbook and its download action were valid.

What changed

• make the generated Deliverable card the sole owner of preview, Files, and download actions
• require the agent to name the completed file in one short closing line without inventing a Markdown link
• align the routine XLSX skill with the same completion contract

This fixes the prompt contract at its source; there is no UI sanitizer or legacy fallback. No schema, migration, environment, or deployment-topology change is involved.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode (passes with the existing Knip configuration hint)
• pnpm architecture:check
• pnpm turbo skills:build
• production acceptance QA will be repeated after merge and deployment with a normal-user spreadsheet request