Audit machine-authored Managed Child instructions

[leoncheng57]

Stacked on #170. Closes #91 for the observable lane.

What

An explicit send-time audit ledger for machine-authored instructions this app sends to child sessions, rendered as machine-authored rows in the delegated-work panel — never as human chat bubbles, and never inferred from transcript wording.

/sessions/ses_mock_managed_ui_parent?directory=/tmp/mock-managed-subagent-project

Design (follows the issue's contract requirements)

• Explicit contract, zero heuristics: a record is appended only at the moment the BFF itself submits an instruction — Managed Child launch assignments, Managed Child follow-up prompts, and refused attempts. The issue forbids inferring instructions from unrelated transcript text; nothing here parses wording.
• Delivery states the BFF actually observed: acknowledged (prompt_async 204) or rejected (safe reason: config verification failure or upstream error). queued never persists because the BFF holds no queue.
• Honest coverage statement: agent-authored native task prompts and external orchestration controllers are not observable from this app; the panel says so (opencode-subagent-instruction-coverage) instead of fabricating records — the issue's explicit fallback when no audit source exists.
• Redaction before persistence: URL userinfo credentials, GitHub/OpenAI/Slack token shapes, Authorization header values, and secret-named key=value assignments; text bounded at 4,000 chars with a truncated flag. Git SHAs and paths survive — an audit log that redacts the instruction is useless.
• Storage: .state/instruction-audit.json (INSTRUCTION_AUDIT_FILE), 0600, atomic serialized writes, capped at 500, corrupt file starts empty (losing audit history must never block the prompt path). Recording is fire-and-forget so it can never fail the send it audits.
• Rendering: records ride the existing SubagentReport; each child row lists its instructions, and records whose child was cleaned up after a failed launch appear in an orphan section — the audit outlives the session it addressed.

Testing

• New tests/instruction-audit.test.ts: redaction cases, bounded text, persistence round-trip, corrupt-file recovery, retention cap, malformed-entry filtering.
• e2e: acknowledged launch + follow-up records with token redaction verified through the API; rejected records for failed submission and refused tampered follow-ups; UI instruction row + coverage footer.
• Full suite: typecheck, 519+ unit, build, 281 e2e.