feat(delegation): add policy-bound profiles

[marcusglee11]

Summary

Implements a v1 of policy-bound delegation profiles for delegate_task.

• Adds optional profile to top-level delegate_task and per-task batch entries.
• Resolves profiles from trusted delegation.profiles config.
• Lets profiles set provider/model/base_url via the existing credential resolver, trusted ACP transport, reasoning effort, toolset allowlist, approval policy provenance, and per-profile max iterations.
• Fails closed on unknown/malformed profiles.
• Rejects profile combined with per-call acp_command / acp_args so raw task payloads cannot mutate trusted transport policy.
• Emits profile/provider/transport/toolsets/approval/max-iteration provenance in subagent result entries.

Safety shape

Profiles are policy objects, not free per-call provider overrides:

• profile toolsets are an upper bound;
• per-call toolsets may narrow but not widen;
• explicit empty toolsets: [] means no toolsets rather than falling back;
• profile ACP fields are config-only and validated;
• profile + per-call ACP override conflicts are rejected by key presence, including acp_args=[].

Review provenance

AA/Oracle architecture review on the issue returned AMEND: implement named policy-bound profiles rather than arbitrary per-call model/provider overrides.

A follow-up AA implementation review returned REVISE; blockers were addressed before this PR:

• empty profile toolsets no longer fail open;
• acp_args=[] conflict is rejected;
• MCP inheritance cannot widen profiled toolsets;
• ACP profile fields are validated.

Tests

• python3 -m py_compile tools/delegate_tool.py
• uv run --with pytest python -m pytest tests/tools/test_delegate.py -q → 148 passed
• uv run --with ruff ruff check tools/delegate_tool.py tests/tools/test_delegate.py → All checks passed!

Related

Builds on / addresses the integrated enhancement proposed in #9459.

[alt-glitch]

Related: #4928 (feature request for named delegation capability profiles), #11169 / #34754 / #41998 (open competing implementations), #44412 (closed earlier attempt).

This PR takes a distinct policy-bound mechanism (toolsets as an upper bound that per-call args may narrow but not widen, fail-closed validation, ACP-override conflict rejection, AA/Oracle review provenance) rather than the flexible override-with-fallback approach of the sibling PRs. Tracking as related so reviewers can compare mechanisms across the cluster — not marking duplicate.

[teknium1]

This is the kanban