Add provider controls for native agent tools

[SawyerHood]

Closes #509.

Summary

• add provider settings to disable native Codex and Claude Code subagents
• hard-cap Codex multi-agent V2 sessions at the root so remote session policy cannot spawn children
• add a Claude Code setting that removes the native Workflow tool
• persist the new preferences and apply them on start, resume, and fork

Verification

• typechecked domain, database, agent runtime, host-daemon contract, server, app, and templates
• ran full tests for database, agent runtime, host-daemon contract, server, app, and templates
• live Codex verification: forced spawn_agent returned collab spawn failed: agent thread limit reached and created no child thread