Enforce managed Claude subagent lifecycle

[areshand]

Summary

• deny Claude's provider-native Agent and legacy Task tools in every headless invocation
• force delegation through registered multiagent subagents so role isolation, lifecycle evidence, and client status exist
• document the executable enforcement boundary and narrow the security backlog

Production evidence

The post-PR #60 E2E preserved the original task and same-session follow-up, but Claude used its built-in Agent tool. The bottom pane therefore remained at zero managed subagents, the supervisor lifecycle gate rejected completion, and the session correctly ended interrupted.

Validation

• cargo test --locked -q (63 passed)
• npm test in control-server (40 passed)
• cargo fmt --all --check
• git diff --check
• claude --disallowedTools Agent Task --version (flag accepted by deployed CLI family)