M4: task tool, subagent spawner, board wiring

Adds the task tool and subagent spawner in harness-tools, and wires spawning/aliasing/reuse and depth limits through harness-app and the job board, so an orchestrator session can launch and track child sessions.

crates/harness-core/src/permission/service.rs

@@ -8,7 +8,7 @@ use ulid::Ulid;
 use crate::event::{AppEvent, EventBus, PermissionRequest};
 use crate::types::SessionId;
 
-use super::rule::{evaluate, Action, Rule, Ruleset};
+use super::rule::{evaluate, evaluate_intersected, Action, Rule, Ruleset};
 
 pub struct AskInput {
     pub permission: String,
@@ -73,6 +73,24 @@ impl PermissionService {
         }
     }
 
+    /// Like [`ask`](Self::ask), but for a subagent: the verdict is the more restrictive of
+    /// the `parent_stack` (rules inherited from the spawning chain) and `child_stack` (the
+    /// subagent's own rules). Used so a child can never widen what its parent forbids.
+    pub async fn ask_intersected(
+        &self,
+        session_id: &SessionId,
+        parent_stack: &[&Ruleset],
+        child_stack: &[&Ruleset],
+        input: AskInput,
+        cancel: &CancellationToken,
+    ) -> Result<AskDecision, AskError> {
+        match evaluate_intersected(parent_stack, child_stack, &input.permission, &input.pattern) {
+            Action::Allow => Ok(AskDecision::Allowed),
+            Action::Deny => Err(AskError::Denied),
+            Action::Ask => self.ask_user(session_id, input, cancel).await,
+        }
+    }
+
     /// Bypasses ruleset evaluation entirely — used by the doom-loop guard, which must ask
     /// regardless of any `Allow` rule.
     pub async fn force_ask(