fix(delegate): guard child credential pool binding

[JabberELF]

Summary

This PR hardens delegate_task credential-pool handling so a child agent does not bind a leased credential from a different provider/runtime endpoint.

It adds two guards:

• _run_single_child() now verifies the leased credential matches the child runtime before calling _swap_credential().
  • Provider identity must match.
  • If both sides expose a concrete base URL, the normalized base URLs must match.
• _resolve_child_credential_pool() no longer blindly shares the parent's pool when the parent pool carries explicit provider metadata that differs from the child provider. It falls back to loading the child provider's own pool instead.

This preserves the existing compatibility behavior for old/test pool objects that lack provider metadata, and keeps custom:<name> compatible with the bare configured custom-provider name.

Why

The existing delegation path can accidentally combine a child runtime from one provider with a leased credential/base URL from another provider. One observed shape is an openai-codex child using the Codex model/runtime while swapping to a Xiaomi OpenAI-compatible endpoint from the credential pool, producing HTTP 404s.

Related but different prior work:

• fix(delegate): credential pool sharing + workspace path hints for subagents #5748 introduced credential-pool sharing for subagents.
• fix: do not inherit api_mode when delegating across providers #25369 fixed cross-provider api_mode inheritance.
• Fixes #20558 #20563 discusses broader delegation/provider 404 behavior.

This PR focuses specifically on the credential-pool lease/swap contamination path.

Tests

python -m py_compile tools/delegate_tool.py tests/tools/test_delegate.py
python -m pytest -o addopts='' tests/tools/test_delegate.py::TestChildCredentialPoolResolution tests/tools/test_delegate.py::TestChildCredentialLeasing -q
python -m pytest -o addopts='' tests/tools/test_delegate.py -q
git diff --check -- tools/delegate_tool.py tests/tools/test_delegate.py

Results:

• py_compile: passed
• targeted credential-pool/delegation tests: 12 passed
• full tests/tools/test_delegate.py: 137 passed
• git diff --check: passed

The only warning seen locally is the pre-existing discord.player / audioop Python 3.13 deprecation warning.

[JabberELF]

Closing — upstream main already implements this via in (line 2371). Child credential pool binding is guarded with at both assignment (line 1187) and lease acquisition (line 1395). This PR is now redundant.