Route Rescue through a native isolated subagent

[vitry]

What to build

Make public Rescue prefer the installed zcode-rescue role, use the strict compatibility fallback only for host routing limitations, and eliminate parent-inline companion execution.

Acceptance criteria

• A constant readiness preflight runs before any Rescue reservation or execution.
• A ready host spawns zcode-rescue with a fresh context and a fixed task that contains no user task or private authorization value.
• A setup-valid installation may use a fixed generic subagent only when the active host cannot express or accepts no agent_type field.
• Missing, damaged, shadowed, foreign, or outdated managed roles stop with an exact setup remedy and never trigger fallback.
• The parent never runs the Rescue companion inline and returns child public stdout verbatim.
• Spawn failure leaves no queued work or unrevoked authorization artifact.
• Skill-contract, routing, hook, and installed-fixture tests pass.

Blocked by

• Install and verify the managed zcode-rescue Agent Role #10