feat: isolate ZCode Rescue in a native subagent

[vitry]

Summary

• adds a managed zcode-rescue Agent Role and routes Rescue through a thread-bound native Codex subagent
• streams bounded semantic progress, preserves same-child choice/steering, and supports production-owned background execution
• hardens cancellation, recovery, ownership, broker lifecycle, permissions, capability transport, and cross-owner data isolation
• publishes a reproducible marketplace snapshot with exact provenance and locked native runtime dependencies
• documents setup, qualification, security boundaries, downgrade, and uninstall behavior in English and Chinese

Issues

Implements and links #10, #11, #12, #13, #14, #15, and #16.

Security and lifecycle boundaries

• caller, parent, child, workspace, turn, and owner identities fail closed
• private background capabilities travel only over FD3/FD4 and are checked for public-output leakage
• terminal/cancel/release winners are generation-fenced and durable across retries, process loss, and broker restart
• foreign status --all results use an explicit metadata allowlist
• marketplace builds use a clean detached source worktree, locked dependencies, exact provenance, and atomic publication

Verification

• npm run check — pass
  • main suite: 997 tests, 994 pass, 3 explicit opt-in skips, 0 fail
  • marketplace snapshot builder: 2/2 pass
  • default qualification: 6 pass, 3 explicit opt-in skips
• npm run test:qualification-required — expected exit 1 only because these authenticated opt-ins are not configured:
  • ZCODE_CODEX_SKILLS_E2E
  • ZCODE_CODEX_RESCUE_E2E
  • ZCODE_REAL_E2E
• git diff --check main...HEAD — pass
• post-suite broker/fake-process reap check after the idle window — 0 residual processes
• per-issue Spec and Quality reviews approved; final whole-diff Spec and Standards reviews report 0 Critical / Important / Minor findings

Notes

• Real authenticated Codex/ZCode qualification is intentionally not claimed without the three opt-ins above.
• This PR is intentionally left unmerged for review; main is unchanged.