Consolidate the seven-module agent lifecycle cycle behind an orchestrator facade

[atomantic]

Problem

Seven modules in the core agent-orchestration path form one tightly-coupled circular cluster (confirmed via madge --circular):

server/services/cos.js → cosAgents.js → cosAgentLifecycle.js → agentManagement.js → agents.js → subAgentSpawner.js → agentLifecycle.js, with several edges reaching back up the chain.

There is no correctness bug today — the team has already broken the static cycle at the load-bearing edges with await import(...), and cosAgentLifecycle.js:453-526 documents exactly why ("a static import here would invert the layering").

The cost is comprehension and change-safety: no module clearly owns agent lifecycle, so changing any one module's exported surface risks a ripple through the other six, and reasoning about a lifecycle transition means holding all seven files in mind at once.

Work

Consolidate the mutually-recursive lifecycle transitions (pause / kill / complete / spawn) behind a single agentOrchestrator facade that owns the state machine, with the current seven modules becoming leaf implementations it calls one-directionally.

This is a Complex refactor in the most load-bearing path in the app, which is why the audit that found it deliberately did not attempt it automatically. It should be done deliberately, with the existing cosAgents.test.js / cleanupAgentWorktree.test.js coverage as the regression net, and probably in more than one PR.

Suggested sequencing:

1. Map every current cross-module call and classify it as "lifecycle transition" vs "leaf operation"
2. Introduce the facade with the transitions, leaving leaves in place
3. Migrate call sites one module at a time
4. Remove the dynamic-import workarounds that exist only to break the cycle

Found by a /do:better audit sweep.

[atomantic]

Partial ship — PR #3471 merged (Refs, not Closes), so this stays open for the remaining sequencing steps.

Done ✓

• Step 1 (map + classify): the transition-vs-leaf classification is now a durable in-repo artifact in the server/services/agentOrchestrator.js header, rather than something the next PR has to re-derive.
• Step 2 (introduce the facade): agentOrchestrator.js sits above the cluster and re-exports the pause/kill/complete/spawn transitions one-directionally. Adds exactly one module to the boot graph (1295 → 1296).
• Disambiguated the two same-named terminateAgent functions — the request-side one in cosAgentLifecycle is now requestAgentTermination; the process-side one in agentManagement keeps its name, symmetric with killAgent.
• Migrated the 4 transition call sites in server/routes/cosAgentRoutes.js — the entire population of transition callers above server/services/.
• Fixed a pre-existing hole in agentImportCycles.test.js: its graph builder only read top-level server/services/*.js, so a cycle routed through one subdirectory hop was invisible — and that edge shape already exists in-tree. It now walks subdirectories.

Remaining ▢

• Step 3 — remaining call-site migrations. Every remaining transition caller is inside the cluster, so each migration is really "move the caller above the facade," not a mechanical import swap.
• Step 4 — remove the await import(...) cycle-breakers. The three forwarders in cosAgentLifecycle.js now have zero callers above server/services/, but cos.js:43 still re-exports them as a compat surface.
• Collapse the three redundant barrels in the cluster.