subagents extension on the generic host surfaces

The rock now owns all subagent policy on top of libpanto-lua's generic APIs:
children are ordinary panto.agent instances over rock-constructed stores,
started with agent:run_async and awaited by arming uv.new_poll on each job's
wake_fd from the tool handler's coroutine.

subagents/jobs.lua carries the session policy the host used to own: the
concurrency gate (4 running, FIFO queue, cancel-while-queued never starts),
the await contract (results in input order; "first" returns settled plus
remaining by identity), and settle-time shaping. subagents/spawn.lua seeds
new children (primary system context, child role, profile body with manifest
metadata), resolves model/reasoning through panto.ext.resolve_model, filters
subagents.* out of the inherited tool set via agent:set_tools, and reads
resume defaults back from stored message metadata. One-shot structured
workers are a null_store agent with a declaration-only output tool,
tool_choice forced, dispatch_tools=false. subagents/progress.lua renders
per-tool-entry cards through the component handle's invalidate seam;
turn_interrupt cancels live children, turn_end closes them.

Spec suite rewritten against fakes of the new surfaces (98 cases), including
gate/queue/cancel bounds, resume-default extraction, one-shot capture via
unresolved tool calls, tool filtering, and manifest seeding.

1 files changed, 38 insertions, 0 deletions

diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..429d8dd
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,38 @@
+[tools]
+lua = "5.4"
+
+# `mise run deps` installs the rocks into ./.rocks (gitignored); `mise run check`
+# puts that tree on package.path and runs the specs. Both pin --lua-version 5.4
+# because a stray system luarocks may default to another Lua.
+#
+# lyaml is a C binding over libyaml and needs the system library present:
+# `brew install libyaml` on macOS, `apt install libyaml-dev` on Debian. The
+# YAML_DIR below points luarocks at Homebrew's prefix when brew is available and
+# otherwise lets luarocks search the usual system paths.
+
+[tasks.deps]
+description = "Install the Lua rocks the extension and specs need into ./.rocks"
+dir = "{{config_root}}"
+run = """
+set -e
+if brew --prefix libyaml >/dev/null 2>&1; then
+    luarocks --lua-version 5.4 --tree .rocks install lyaml YAML_DIR="$(brew --prefix libyaml)"
+else
+    luarocks --lua-version 5.4 --tree .rocks install lyaml
+fi
+luarocks --lua-version 5.4 --tree .rocks install toml2lua
+luarocks --lua-version 5.4 --tree .rocks install luv
+luarocks --lua-version 5.4 --tree .rocks install dkjson
+"""
+
+[tasks.check]
+description = "Run the specs against ./.rocks"
+dir = "{{config_root}}"
+run = """
+set -e
+# Without the tree the specs still pass, but every case that needs a rock skips
+# itself; install once rather than reporting a green run that tested less.
+[ -d .rocks ] || mise run deps
+eval "$(luarocks --lua-version 5.4 --tree .rocks path)"
+lua spec/run.lua
+"""