fix(agentic): stabilize Task subagent execution

[wsp1911]

Summary

• Run foreground and background subagent coordinator calls in independent Tokio tasks to avoid overflowing the Tokio worker stack.
• Align send_input and cancel permission resources with the public agent_id contract.
• Propagate Tool cancellation through background startup and monitor both Tool and parent-turn cancellation.
• Clean up prepared sessions and registered outcomes when background startup is cancelled.
• Add regression coverage for permission intents and cancelled background startup.

Type and Areas

Type:

Regression fix

Areas:

Rust core, Agentic TaskTool, subagent coordination

Motivation / Impact

This fixes three related Task subagent regressions:

• Spawning a subagent could terminate the desktop process with thread 'tokio-rt-worker' has overflowed its stack.
• send_input could fail before execution with Validation error: session_id is required, even though the public tool contract supplies agent_id.
• After moving background startup behind a Tokio task boundary, steering or round injection could cancel the Tool call while allowing the detached startup task to continue creating an unreachable subagent.

Subagent execution now has an independent Tokio stack boundary, permission validation follows the public identifier contract, and cancelled background starts do not remain as orphaned work.

Verification

• pnpm run fmt:rs
• cargo test -p bitfun-core --lib permission_intents_follow_the_agent_id_contract -j 1 -- --nocapture
• cargo test -p bitfun-core --lib background_subagent_start_honors_an_already_cancelled_tool -j 1 -- --nocapture
• cargo check -p bitfun-core -j 1
• git diff HEAD --check
• Manual verification: subagent spawning no longer crashes the process.

Reviewer Notes

The first cancellation-test invocation reached the command timeout while compiling; an identical rerun completed successfully. Only the existing windows_app dead-code warning was emitted.

A full workspace test and desktop steering E2E were not run. The focused tests cover the corrected permission contract and the already-cancelled background-start path.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.