Add foreground read-only subagents

[Astro-Han]

Summary

• Add first-class child AgentRun lineage with parentRunId / agentName, keeping child runs out of the parent transcript and model history by default.
• Add foreground agent_spawn, agent_list, and bounded agent_output over the existing runtime/run/event/artifact spine.
• Run child agents with a separate explore-mode backend, local read-only non-prompting tools, parent abort propagation, recovery handling, and desktop subagent result rendering.
• Wire the same read-only subagent surface into headless isolated runs.

Closes#49

Review notes

• Fresh-eye final review: ship; no P0/P1/P2/P3 findings.
• Claude final review: no P0/P1 blockers; remaining P3 notes addressed where zero-cost, with typecheck confirming the narrowing concern is not a build break.

Verification

• git diff --check
• npm run typecheck
• npm run -w @maka/runtime test -- packages/runtime/src/__tests__/ai-sdk-backend.test.ts packages/runtime/src/__tests__/session-manager.test.ts packages/runtime/src/__tests__/subagent-tools.test.ts
• npm run -w @maka/headless test -- packages/headless/src/__tests__/tools.test.ts
• npm run -w @maka/desktop build:main && node --test apps/desktop/dist/main/__tests__/ipc-surface-contract.test.js apps/desktop/dist/main/__tests__/subagent-ui-contract.test.js
• npm run build
• npm run check:stale