feat(durable,subagent): criterion benchmarks + durable subagent promise adapter

[bug-ops]

Summary

• feat(durable): criterion benchmarks and exactly-once p99 CI gate #4950 — Add 10 criterion benchmark groups for zeph-durable covering all NFR-DE-01..07 targets, plus NFR gate tests
• feat(sub-agents): durable promise for subagent spawn/await resume (P4) #4954 — Add durable promise adapter in zeph-subagent for crash-resumable subagent spawn/await

Closes #4950, Closes #4954

Changes

#4950 — Criterion benchmarks (zeph-durable)

crates/zeph-durable/benches/durable_benches.rs:

• bench_step_run_idempotent / bench_step_run_atleastonce / bench_step_run_exactly_once_n (N=5)
• bench_parallel_n (N=8), bench_replay_cursor_n (N=5000)
• bench_journal_append_buffered / bench_journal_append_acked
• bench_payload_seal / bench_payload_open (4 KiB, real XChaCha20-Poly1305)
• bench_prune_batch (10 000 entries, 500-row batches, iter_batched setup outside timer)

crates/zeph-durable/tests/nfr_gates.rs:

• nfr_de_07_append_throughput_ge_1000_per_sec — runs in CI
• nfr_de_01_exactly_once_n5_p99_le_5ms and nfr_de_02_replay_cursor_5000_steps_le_5ms — #[ignore] (release-only; 5 ms bound is normative per NFR-DE-01/02, not loosened)

#4954 — Durable subagent promise adapter (zeph-subagent + zeph-core)

crates/zeph-subagent/src/durable.rs (new):

• SubagentResult { output, error, state } — carries both success and failure case
• DurableResolverSeat — Zeroizing<[u8;32]> token, consumed by background task after spawn (INV-9 boundary)
• make_durable_promise, await_durable_subagent (with subagent.durable.await span), resolve_durable_promise (with subagent.durable.resolve instrument span)

crates/zeph-core/src/agent/subagent_commands.rs:

• maybe_make_durable_seat called from both handle_agent_background and handle_agent_spawn_foreground, gated on durable.enabled && durable.subagent
• When either flag is false, SpawnContext.durable_resolver = None — existing spawn/await path is byte-identical

Scope boundary (spec §1038 / INV-9): Finished-child replay only. Still-running-child crash recovery is out of scope — resolver token recovery is impossible by design (only BLAKE3 hash persisted). Documented in module doc and playbook.

Test plan

• cargo +nightly fmt --check — CLEAN
• cargo clippy --workspace --all-targets -- -D warnings — CLEAN
• cargo nextest run --workspace --lib --bins — 10670 passed, 0 failed
• cargo bench -p zeph-durable --no-run — benches compile
• cargo nextest run -p zeph-durable --test nfr_gates — nfr_de_07 passes, 2 #[ignore] skipped
• cargo test --doc -p zeph-subagent — 23 passed
• RUSTFLAGS="-D warnings" cargo check --workspace --all-targets — CLEAN