feat: add fail-closed subagent delegation gates (#266)

Adds subagent_gate.py following the author_proofs/review_proofs pure-policy
pattern:

- assess_subagent_delegation: deterministic write tasks (issue claim,
  branch creation, code edits, commits, PR creation, review, merge,
  cleanup) are blocked for subagents unless explicitly allowed with a
  recorded justification and the full inherited gate context (issue lock,
  branch/worktree path, identity/profile, allowed tool class, command
  deny list, validation ledger requirement, final report schema);
  read-only delegation stays allowed; unknown task types fail closed.
- validate_subagent_report: subagent output is accepted only when it
  carries the same proof fields as a parent workflow final report.
- Operator guide: new subagent_delegation rule in _GUIDE_RULES so MCP
  clients discover the policy.
- tests/test_subagent_gate.py: 13 tests covering blocked write
  delegation, justification requirement, missing/blank inherited
  context, allowed read-only delegation, unknown tasks, and invalid
  subagent final reports.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

gitea_mcp_server.py

@@ -3483,6 +3483,19 @@ _GUIDE_RULES = {
         "small fixes, review fixes, conflicts, emergencies). Main checkout: "
         "read-only inspect, fetch, create worktrees, post-merge stable "
         "update, explicit repair only."),
+    "subagent_delegation": (
+        "Deterministic write workflows (issue claim, branch creation, code "
+        "edits, commits, PR creation, review, merge, cleanup) run inline in "
+        "the parent session — subagents are blocked for them unless "
+        "explicitly allowed with a recorded justification. An authorized "
+        "write subagent must inherit the full gate context: issue lock, "
+        "branch/worktree path, identity/profile, allowed tool class, "
+        "command deny list, validation ledger requirement, and final report "
+        "schema. Subagent output is accepted only with the same proof "
+        "fields as the parent workflow; read-only delegation (search, "
+        "inventory, summarize) needs no explicit authorization. Enforced "
+        "fail closed via subagent_gate.assess_subagent_delegation and "
+        "validate_subagent_report (#266)."),
 }
 
 _COMMON_WORKFLOWS = [