Add profile-aware parallel subagent fleets / 新增可配置并行子智能体 Fleet

[SivanCola]

Summary

• Add runtime-resolved profile and write_paths support to task; profile bodies become the complete child system prompt instead of inheriting the concise default.
• Add fleet for 2–64 independently reported subagent tasks, with foreground or background execution and fixed registration order: task → parallel_tasks → fleet.
• Add a session-wide scheduler with total concurrency, writer concurrency, normalized write-path claims, nested fail-fast behavior, and asynchronous background queueing.
• Enforce writer claims across task, fleet, parallel skill entry points, parent tools, Bash sandbox roots, and dynamically loaded Economy/MCP tools.
• Add Desktop controls for concurrency limits and read-only profile editing, plus English and Chinese documentation.

Why

Custom subagent profiles were only directly runnable through the serial skill path. A workload such as ten independent documents therefore queued one child after another even when the work and output paths were independent.

This change makes profile execution available to the parallel task surface while keeping write safety explicit. Writers with disjoint declared paths can run concurrently; a writer that omits write_paths conservatively claims the whole workspace.

Safety and behavior

• max_subagent_concurrency defaults to 6; max_parallel_writers defaults to 3. Both normalize to 1–32 and writers never exceed total concurrency.
• Fleet preflight rejects overlapping, parent/child, case-equivalent, glob, symlink-escape, and workspace-escape claims before starting any item.
• Parent writes take an atomic reservation before PreToolUse and hold it through execution, closing check-before-write races with background subagents.
• Bash is retained for path-bound writers only when its enforced sandbox roots can be rebound to the claim; otherwise it is removed.
• Background task returns its job id before waiting for a scheduler slot.
• Item failures are isolated and reported in the aggregate rather than cancelling unrelated fleet items.

Backward compatibility

Surface	Old data/caller behavior after upgrade	Conclusion
Existing task calls	New fields are optional. Writer calls without write_paths remain valid and now take a conservative whole-workspace scheduling claim.	Compatible; safer serialization.
Existing TOML config	Missing concurrency keys resolve to 6/3. The new scalar keys are additive, and older TOML decoders ignore unknown keys.	Backward-safe.
Existing subagent profile frontmatter	Missing read-only remains the legacy writable default. CLI/Desktop round-trip the managed field without dropping unrelated frontmatter.	Backward-safe.
Desktop Wails settings payload	New frontend code falls back to 6/3 when fields are absent; older frontends ignore added response fields.	Cross-version safe.
Persisted subagent transcripts	Stored data remains readable. As with any tool-schema change, continuation safely rejects a registry-hash mismatch instead of replaying under a different capability set.	Safe failure; no data corruption.

Verification

• go test ./...
• cd desktop && go test ./...
• go test -race ./internal/agent ./internal/boot ./internal/config ./internal/skill
• cd desktop/frontend && pnpm typecheck && pnpm test:typecheck && pnpm test
• ./scripts/cache-guard.sh
• Focused coverage for path conflicts, parent-write TOCTOU, scheduler queues, nested fail-fast, profile prompt ownership, fleet parallelism, schema stability, and read-only round trips
• Real-provider ten-document paid scenario was not run; deterministic fleet concurrency tests cover the scheduler behavior.

Integration notes

• Feat: Add Agent Teams, Subagents, Agent View, and Usage Tracking support #5980 is conceptually related but adds separate team/definition infrastructure and has no changed-file overlap with this PR.
• Add cache-stable agent capability runtime / 新增缓存稳定的 Agent 能力运行时 #6623 overlaps internal/agent, internal/boot, and internal/config; this branch may need a rebase if that PR lands first.

Cache impact

Cache-impact: medium — the upgrade intentionally adds the fleet tool and extends the task schema, causing one prompt-cache cold start. After that, tool order is fixed and profile names never enter tool schemas or the parent system prompt.

Cache-guard: ./scripts/cache-guard.sh passed, including all release cache-hit scenarios.

System-prompt-review: required — custom and named built-in profile bodies now intentionally become the complete child system prompt. Ordinary task and read_only_task defaults are unchanged.