fix: inherit Plan mode permissions when spawning sub-agents

[w0wl0lxd]

Summary

Fixes a security bypass where the model could escape Plan mode restrictions by spawning sub-agents.

Problem

When in Plan mode (read-only), the model could bypass restrictions by spawning sub-agents via the Task tool. Through reasoning/thinking or arbitrary decisions, the model could instruct sub-agents to run with full edit/write/bash permissions - completely circumventing Plan mode's safety guarantees.

Solution

• Sub-agents from restricted parents (edit="deny") now run as Plan agent
• Inherits Plan's bash whitelist (read-only commands: grep, ls, git status, etc.)
• Explicitly disables edit/write tools for sub-agents
• Throws descriptive error if Plan agent is unavailable
• Adds comprehensive tests for Plan mode security restrictions

Testing

• Added 7 new tests in test/tool/task.test.ts
• All existing tests pass

Fixes#6527

[thoroc]

Rebase needed

[github-actions]

Closing this pull request because it has had no updates for more than 60 days. If you plan to continue working on it, feel free to reopen or open a new PR.