fix(runtime): harden sandbox determinism, drain pending agents on failure

[Mourey]

Summary

Code audit of the runtime surfaced four correctness issues in how workflow scripts are sandboxed and how results are typed. All fixes are covered by new regression tests (24 → 30 tests, npm test green: biome + tsc + unit).

1. Math.random aliasing bypasses the determinism check

assertDeterministicAst rejects literal Math.random() calls, but the sandbox receives the host Math object, so an alias slips straight through:

const f = Math.random   // not a CallExpression — passes the AST check
f()                     // real host Math.random runs

The sandbox now gets a Math shim that inherits every deterministic method from the host object but defines random as a throwing stub — the direct form is still caught at parse time with a nice error, and aliases now fail at runtime with the same message.

2. Parser allows Date.parse/Date.UTC, runtime crashes on them

The parser (and its tests) deliberately allows the deterministic Date statics, but Date was never added to the vm context, so any script using them died with ReferenceError: Date is not defined. The sandbox now gets a frozen Date shim exposing parse/UTC; now() throws, and since the shim is a plain object, new Date() is a TypeError even if the AST check is bypassed by aliasing.

3. Subagents leak when the script throws

runWorkflow only drained pendingAgentRuns on the success path. A script that fires un-awaited agent() calls and then throws left real LLM subagent sessions running detached — never awaited, never surfaced. The drain now happens in a finally, so pending runs are always settled before the error propagates.

4. types/workflow.d.ts contradicts documented null behavior

The runtime maps failed agent()/parallel()/pipeline() results to null, and the tool's own prompt guidelines tell the model to null-check — but the ambient types promised non-nullable results. The declarations now return T | null / Array<T | null> with doc comments explaining when.

Test plan

• npm test — biome check, tsc build, 30/30 unit tests pass
• New tests: aliased Math.random rejected at runtime; deterministic Math methods still work; Date.parse/Date.UTC work end-to-end; pending agents drained when the script throws; parallel preserves input order with nulls on failure; pipeline passes (prev, original, index) with nulls on failure

One note for reviewers: the new parallel-ordering test uses a Promise.withResolvers gate instead of a timer so completion order is deterministic under any concurrency level.