Add Plan/Build/Explore/General agent selector for Managed Children

[leoncheng57]

Stacked on #163 (fix/managed-child-model-picker). Do not merge before #163.

What

Adds an agent selector to the human-authorized Managed Child launch lane. A Managed Child can now be launched as Plan, Build, Explore, or General, with the policy projected onto the child session at creation time.

/sessions/ses_mock_done?directory=/tmp/mock-project

Design

• Agent catalogue (GET /api/managed-child-agents): only plan, build, explore, general, filtered against the live upstream agent list. Hidden or invalid agents are dropped; can-modify agents must cover every discovered tool; an empty or all-allowlisted tool catalogue fails closed.
• Access classes: plan/explore are read-only, build/general can modify. Explore receives the same hard mutating-tool deny ceiling as Plan — its resolved agent policy is not trusted, because project-level merges can weaken it (see Allow Build Task children after a parent previously used Plan #75).
• Explicit authorization: launching a can-modify agent requires authorization: "modify" in the request body; read-only agents reject the field. The UI backs this with a confirmation checkbox that resets whenever the selected agent changes.
• Metadata v2 (customDcaManagedChild): requestedAgent (legacy requestedMode accepted as a Plan/Build alias), authorization, version: 2, and a policyFingerprint (sha256 of the permission ruleset) verified against effectivePolicyObserved after re-reading the created session.
• Follow-up prompting: promptManagedChild re-verifies session id, directory, agent, and policy fingerprint before every prompt; any mismatch is a 409 ("configuration could not be verified"), never a silent fallback.
• Fail closed on malformed metadata: sessions carrying the managed marker but invalid metadata expose managedConfigurationPresent; the prompt route 409s instead of falling back to root prompting, so a tampered child can never be driven under a root policy.

Security notes

• This route remains BFF-only and must never be registered as an agent tool (per Design: fully configurable sub-agents independent of parent mode and model #148 / PR Add configurable managed subagents #156).
• The browser never authors raw permission rules; it names an agent id and (for can-modify agents) an explicit authorization token. All rule projection happens server-side against the resolved upstream agent policy.
• Creation-time verification rereads the session and compares every security-relevant field before the first prompt is submitted; partial-launch failures delete the child or report that it may remain.
• Tamper coverage: new mock endpoints (/test/session-policy/tamper, /test/managed-metadata/tamper) drive e2e tests that mutate the child's policy or metadata between launch and follow-up and assert the 409.
• The e2e explore fixture deliberately carries an adversarial edit: allow override to prove the hard ceiling wins.

UI

• Launch dialog: agent selector with read-only/can-modify grouping, confirmation checkbox for can-modify agents, mobile-safe.
• Conversation composer on a managed child shows a fixed-agent chip (opencode-managed-child-agent-fixed) instead of the Plan/Build toggle.
• Sub-agent ledger rows show a Managed Child badge with requestedAgent provenance.
• Terminology: human-launched children are "Managed Children"; "sub-agent" stays reserved for native task delegation.

Testing

• npm run typecheck, npm test (511), npm run build
• Full Playwright E2E on isolated ports: 279 passed, 1 skipped

Closes #162.