* fix(agents): make subagent hard-deny list non-overridable and deny message tool
The always-deny list for subagent sessions (gateway, cron, message, sessions_send,
conversations_*) could be overridden by ordinary allow/alsoAllow config entries,
letting a configured subagent profile re-enable direct user delivery outside the
announce chain. The hard-deny layer now applies unconditionally; message joins the
list so resumed/visible subagent sessions cannot send directly either (hidden
launches already disabled it at spawn time).
* chore: re-fire CI
* chore: re-fire CI against fixed main baseline
* test(agents): workspace authority reflects non-overridable subagent deny list
The delegating-worker rejection case relied on alsoAllow bypassing the
subagent hard-deny list; with the bypass closed the policy owner blocks
sessions_spawn and the worker stays confined, so the guard has nothing to
reject.
Peter Steinberger
8994c7799b