feat(subagent): verify requires_tools pre-spawn with fail-closed preflight - #1224

Summary

• spawn_agent accepts requires_tools (canonical names); the dispatcher runs a capability preflight against the worker capability mount before any session, telemetry, or worktree exists, and rejections return a reroute hint naming a capable director or profile
• runSubAgent re-checks stamped requires_tools against the mounted tools at run start; a tool missing in between fails as stale_snapshot (setup_error, non-continuable), naming every missing tool
• Session records stamp requiresTools only (no revision field — the profiles load-diagnostics revision stays in profiles.ts); blank requires_tools entries reject fail-closed
• requires_tools accepts the Tier 3 leaf reporting channel (submit_result/ask_director) on leaf workers; tier-gated rejections name Tier 3 leaf directors

Verification

• bun run check passes (7609 pass, 0 fail across 514 files)
• bun test src/subagent/capability-preflight.test.ts src/subagent/agent-fleet-requires-tools.test.ts src/subagent/run-requires-tools.test.ts src/agent/profiles-snapshot.test.ts passes

Fixes CL-9476