fix(subagent): reap orchestration-dispatched sub-agent handles

[bug-ops]

Summary

SubAgentManager::collect() was only ever invoked from the interactive /agent
polling path (poll_subagents()), never from the orchestration dispatch loop
(run_scheduler_loop). Every plan-executed sub-agent leaked its handle and never
wrote a final TranscriptMeta sidecar.

A naive ordering fix (call collect() right after the verifier reads the trace)
is not sufficient: status_tx flips to Completed before the corresponding
TaskEvent is even enqueued, and SchedulerAction::Verify is never emitted for
Failed outcomes or when verify_completeness is disabled, so a Verify-only reap
would still leak most terminal tasks.

Instead, grounding trace reads are decoupled from handle residency:

• SubAgentManager::transcript_path_for() resolves the transcript path from
  config alone, independent of whether the handle is still tracked.
• build_tool_trace_for_task and resolve_whole_plan_trace_paths (whole-plan
  grounding, a related residency hazard found during implementation) both now
  use it, so reaping can no longer silently degrade verifier grounding to
  fail-open None.
• Agent::collect_finished_subagents() reaps every Completed/Failed/Canceled
  handle once per scheduler tick.

specs/009-orchestration/spec.md updated to reflect that grounding no longer
depends on handle residency.

Closes #6288

Test plan

• cargo +nightly fmt --check — clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings — clean
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — 13808 passed, 0 failed
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler" — clean
• cargo test --doc -p zeph-subagent — clean, including new transcript_path_for doctest
• 6 new/extended regression tests added, covering: the leak fix itself, grounding survives collection (per-task and whole-plan), None-manager no-op, Canceled-state reap
• gitleaks protect --staged — clean