fix(subagent): count mailbox spill remaining as omitted body

[TheGreatAxios]

Summary

• Mailbox digest spill notices report remaining as the omitted body length when the inline field keeps no prefix.
• Non-empty spilled reports no longer claim "0 more chars omitted", so the parent still fetches report_uri.
• Spilled errors use the same truncation-notice language and name error_uri for read_file.

Verification

• bun run check green (lint, typecheck, dead-exports, build, 7852 tests)

Fixes CL-9494

[linear-code]

CL-9494