agent/runner: ship repo.stats before job.finished in RunCheck/RunUnlock

RunCheck and RunUnlock were calling sendFinished before reportStats,
inverting the required job.started → log.stream → repo.stats →
job.finished envelope order. Move reportStats ahead of sendFinished in
both functions to match the pattern already correct in RunPrune.

Strengthen TestRunCheckShipsCheckStatus, TestRunCheckErrorsFoundShipsErrorsStatus,
and TestRunUnlockClearsLock with the same position-index ordering
assertions used by TestRunPruneShipsExpectedEnvelopes; these assertions
would have failed against the pre-fix code.

internal/agent/runner/runner.go

@@ -276,7 +276,6 @@ func (r *Runner) RunCheck(ctx context.Context, jobID string, subsetPct int) erro
 	var seq atomic.Int64
 	res, err := env.RunCheck(ctx, subsetPct, r.streamHandler(jobID, &seq))
 	finishedAt := time.Now().UTC()
-	r.sendFinished(jobID, finishedAt, err, nil)
 
 	// Determine check status string.
 	checkStatus := "ok"
@@ -297,6 +296,8 @@ func (r *Runner) RunCheck(ctx context.Context, jobID string, subsetPct int) erro
 		slog.Warn("runner: stats.report after check failed", "job_id", jobID, "err", rerr)
 	}
 
+	r.sendFinished(jobID, finishedAt, err, nil)
+
 	if err != nil {
 		return fmt.Errorf("runner check: %w", err)
 	}
@@ -313,7 +314,6 @@ func (r *Runner) RunUnlock(ctx context.Context, jobID string) error {
 	var seq atomic.Int64
 	err := env.RunUnlock(ctx, r.streamHandler(jobID, &seq))
 	finishedAt := time.Now().UTC()
-	r.sendFinished(jobID, finishedAt, err, nil)
 
 	if err == nil {
 		lockFalse := false
@@ -323,6 +323,8 @@ func (r *Runner) RunUnlock(ctx context.Context, jobID string) error {
 		}
 	}
 
+	r.sendFinished(jobID, finishedAt, err, nil)
+
 	if err != nil {
 		return fmt.Errorf("runner unlock: %w", err)
 	}