feat(multi-subagent): record Turn-bound native child reports

[huangruiteng]

Problem and behavior

A Goal's max_children and model preference did not show whether a host-native child was attempted, skipped, rejected for capacity, or adopted by the parent. This PR adds a provider-neutral, Turn-bound native-child record/read contract. It stores typed decision, result, and parent-review reports with a stable operation ID; duplicate reports are idempotent, conflicts are rejected, and capacity/host failures stop same-Turn spawn retries while parent work can continue.

The shared read model keeps the configured ceiling separate from reported starts. Missing reports remain unknown. Coordinator reports are explicitly coordinator_reported and host_attested=false; they do not become authoritative host observations. Bound loopx delegation keeps its existing authority.

User entry points

• CLI and managed agent-context can record or read the exact Turn's report. Goal status JSON and Markdown use the same projection.
• The dashboard shows a compact, provenance-labeled card only for a Goal with enabled multi_subagent and a reported native decision. The existing configuration editor remains the configuration owner. Desktop/mobile and Chinese/English packaging were checked.
• Lark currently shows team-plan proposals rather than host-native child activity; there is no existing native activity view to change in this slice.

Validation

• 32 focused Python tests; 13 control-plane TS tests; Ruff; control-plane typecheck.
• Dashboard desktop build, focused desktop/mobile browser smoke, packaged personal-workspace smoke, chat bundle build/install and source verification.
• Public boundary scan: 0 errors; two unrelated existing registry warnings.
• The broad smoke:home-browser run stopped at its Files projection assertion before reaching this card's assertion. The focused native-child browser path passed; the broad failure's cause is not established here.

Remaining boundary

This implements the generic reporting and readback substrate for #5051. LoopX cannot attest an arbitrary host-native tool call without a host integration. This PR does not add a Codex-specific adapter or claim host-observed receipts; keep #5051 open for adapter-backed attestation and end-to-end acceptance.