Hardening patch. Re-running the install prompt upgrades in place.
The six roles are now hard leaf agents. The four executor roles get disallowedTools: Agent, Workflow; verifier extends its read-only exclusions with the same; scout/Explore were already leaves via their tools allowlist. Each also carries an explicit "you are a leaf agent" line, so a genuinely mis-routed task is reported back instead of silently re-delegated.
This replaces v1.1.1's prompt-only guard with capability removal. The prompt guard put the routing table into every subagent's context, so a mech-executor could pattern-match its own task and re-delegate — observed cascading four levels deep in a real incident. Verified before merge: with the prompt guard a nested role still spawned (a haiku scout ran real work, out=794 tokens); with disallowedTools the spawn is blocked (out=24, idle) and the role does the work itself. Thanks @dromsak (#6).
Full details: CHANGELOG.md
