v0.12.0

feat: let an agent start other agents, and bound what that can do

"Spawn two subagents for adversarial review" had no answer before this: the
system prompt never mentioned that the binary can run another agent, and there
was no way to run one that returns an answer a caller can read.

One shot
- `-p "<task>"` runs one prompt and prints the final answer to stdout, nothing
  else, so it can be read out of a pipe. Exit 0 with an answer, 1 with the
  reason on stderr, 2 for an empty prompt, 3 when the agent limit refused it.
- The answer is the last assistant message that carries no tool calls. Taking
  the last assistant message reported tool narration — "inspecting the parser" —
  as a finished answer with exit 0 when a run failed after a tool call.
- A turn that did not finish fails instead of printing what it had. A stalled
  stream, a cut stream, a token limit, an abort and a cancellation are all
  fragments, and a caller reading stdout cannot tell a short answer from half
  of one.
- `--list-sessions` and `--list-opencode-models` no longer pre-empt a prompt.

Cut streams
- A stream that ends with no `[DONE]` and no finish reason was cut off, and now
  says so: the turn ends as `truncated`, keeping the partial text. It used to be
  indistinguishable from a completed answer, so a dropped connection handed back
  half a sentence and every exit code said success. Measured: a socket closed
  mid-generation returned "partial thought that got cut off before", exit 0.

Subagents in the system prompt
- The agent is told how to start another with this binary's real path, how to
  run several at once, how to quote a task, what a failure looks like, and when
  not to bother. The bash ceiling and the agent limit are stated from the values
  actually in force.

Bounding it
- Every process the bash tool starts carries `RUPI_SUBAGENT=1`, and a starting
  agent also looks for a copy of itself among its parents. The marker alone was
  advisory: `env -i` stripped it and the grandchild was told it could start
  agents of its own, two levels deep and unaware.
- `--max-agents` (default 12, `RUPI_MAX_AGENTS`) refuses a start beyond that
  many live processes of the same binary. Prompt text is not a limit. Measured
  with a provider that made every agent start another: the chain stopped at 12.

511 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TrSm1KU4eXBomuonnfDaRb