Consolidate post-check logic (#5003)

Right now, some post-run logic is does in `Run()`
(`CheckRequiredDefinitions();` and
`context_.sem_ir().set_has_errors(unit_and_imports_->err_tracker.seen_error());`)
whereas other parts are done by `Finalize`. Noting the goal to move
things off `Context`, this consolidates into a new `FinishRun`. Note
#4962 is adding another bit of post-run that can be consolidated in;
this seems likely to keep growing slowly.

Note this also creates more parity with mutation source, like the
`context_.scope_stack().Pop();` matches the push done by
`CheckUnit::ImportCurrentPackage` and
`context_.inst_block_stack().Pop()` was pushed in `CheckUnit::Run()`.

Also makes `exports()` more consistent with other Context APIs. Makes
`VerifyOnFinish` `const` so that it can't accidentally mutate state, and
is instead only validating that the Context is in its expected
configuration at completion.

toolchain/check/decl_name_stack.cpp

@@ -158,7 +158,7 @@ auto DeclNameStack::AddName(NameContext name_context, SemIR::InstId target_id,
         // scope. Otherwise, it's in some other entity, such as a class.
         if (access_kind == SemIR::AccessKind::Public &&
             name_context.initial_scope_index == ScopeIndex::Package) {
-          context_->AddExport(target_id);
+          context_->exports().push_back(target_id);
         }
 
         name_scope.AddRequired({.name_id = name_context.name_id,