Harden Grok subagent lifecycle and isolation

[Walvez]

What changed

• filter the Grok child-process environment and allow explicit opt-in passthrough
• canonicalize repository and linked-worktree paths
• correct MCP annotations and protocol-version negotiation
• require renewed write-scope confirmation for worker follow-ups
• make cancellation return sessions to idle and terminate failed or timed-out processes
• expand secret-shaped text redaction
• raise the supported runtime to Node.js 22 and test Node.js 22/24 in CI
• add deterministic tests for security boundaries, lifecycle behavior, protocol metadata, and worktree guards

Why

The initial release had strong sandbox and worktree boundaries, but several implementation details could reject valid macOS worktrees, inherit unrelated host credentials, misrepresent MCP side effects, or leave failed agents occupying process slots. The previous tests mostly covered package layout and tool discovery, so these paths lacked regression coverage.

Validation

• npm test
• npm run test:e2e
• git diff --check

The authenticated E2E test confirmed the filtered environment still supports the local Grok login and a real read-only ACP session.