v1.8.0

Live tool progress end to end: SSE heartbeat, delegated-run visibility, ACP client with permission forwarding, Codex app-server support.

• Live tool_progress on the jobs SSE stream. While any tool call is in flight, a
  frame each second lists every running call with its elapsed time; the web UI turns the
  pending ellipsis into a live counter. ToolCallEvent gained CallId and
  ParentCallId, so a sub-agent's tools attribute to the spawn_subagent call they run
  under and render nested (spawn_subagent … 5.9s ↳ exec_shell 5.9s). tool_result now
  carries the notifier's own measured durationMs. A keep-alive comment goes out every
  15s when nothing is running, so an idle-timeout proxy can no longer drop the connection
  mid-turn — which cancelled the turn and killed any delegated CLI with it.

• delegate_to_claude streams. Switched to --output-format stream-json; the run's
  own tool calls surface live as children of the delegation (delegate_to_claude ↳ PowerShell 0.2s). The terminal result event carries the same envelope as before, so
  session resume and usage logging are unchanged. A run killed mid-stream now salvages
  the assistant text seen so far. Verified against claude 2.1.161.

• ACP client: delegate_to_acp_<name> tools. Tools:AcpAgents entries spawn
  long-lived agents speaking ACP over stdio (e.g. another DaggerAgent via dagger acp),
  pooled per (job, agent, cwd) — successive delegations continue one live session, no
  per-call spawn, no session-id juggling. The agent's activity feeds the same
  tool_progress pipeline. Gated by AllowCliDelegation.

• Permission forwarding. PermissionPolicy: deny | allow | ask per ACP agent. ask
  routes the child agent's permission request to whoever is driving the job: the web UI
  renders inline Allow/Reject buttons in the transcript (permission_request frame,
  POST /agent/permissions/resolve), and an agent-side ACP session forwards it upward as
  a session/request_permission of its own — editor ⇄ DaggerAgent ⇄ delegated agent.
  Nobody driving, or no answer in PermissionTimeoutSeconds, falls back to deny.

• Codex app-server protocol. Protocol: codex-app-server on an agent entry drives
  Codex's JSONL dialect (thread/turn/item, approvals answered accept/decline) behind the
  same tool surface, pool, progress feed and permission path. Coded against the app-server
  documentation and verified against a protocol-faithful stand-in; not yet smoke-tested
  against a real codex binary.

Closes #7 and #8.