Catalogue the sub-agent guide with a retained-agent capability matrix

[leoncheng57]

Stacked on #169 (feat/managed-child-agent-selector), which is stacked on #163. Do not merge before both.

What

Catalogues docs/subagents.md on the in-app Docs page and adds a retained-agent capability/restriction matrix documenting the fixed Managed Child roster (plan, build, explore, general) introduced in #169.

/docs?directory=/tmp/mock-project
full:/docs/subagents?directory=/tmp/mock-project

Changes

• client/lib/docs.ts: new subagents entry (category: architecture, source docs/subagents.md). Relative links inside the doc now resolve in-app where catalogued.
• docs/subagents.md:
  • New "Retained agents and the capability matrix" section: per-agent access class, session ceiling at launch, and authorization requirement.
  • Restriction notes: read-only agents reject authorization while can-modify agents require it, browser never authors raw rules, metadata v2 (requestedAgent, policyFingerprint, legacy requestedMode alias), follow-up prompt re-verification, fail-closed on invalid metadata, and why Explore gets the Plan deny ceiling instead of trusting its resolved policy.
  • Managed-child prose updated from "Plan/Build agent" to the four retained agents.
• docs/contributing/index.html: reading-index card for docs/subagents.md.
• tests/docs.test.ts: catalogue entry assertions, plus a consistency test that parses the matrix rows out of the Markdown and requires them to equal MANAGED_CHILD_AGENT_IDS from the server module — the doc cannot drift from the code roster without failing the build.
• tests/e2e/smoke.ui.spec.ts: docs-center coverage opening the sub-agent guide and asserting the matrix renders all four agents.

Testing

• npm run typecheck, npm test (513), npm run build
• Full Playwright E2E on isolated ports: 280 passed, 1 skipped