feat(codex): surface a native sub-agent's outcome, result and session

A team-of-agents spawn drew a capsule with nothing in it: no id badge after a
reload, no sign of how the child ended, and no trace of what it reported. All
three were on disk the whole time.

0.153.4 moved `SubAgentActivity` out of `event_msg/sub_agent_activity` and into
the `item` of `event_msg/item_completed`, leaving the parser's arm dead — a
rollout with 26 of the new records matched none of them. `item.id` is the
spawn's `call_id`, the same key the flat `event_id` was, so both shapes now
normalize to one record and a capsule keeps its `agent_id` across a reload.

The child's closing report reaches the parent only as a `response_item`
`agent_message` authored by `/root/<name>`, with no ThreadItem twin, so it
crosses no wire and was dropped on reload as well. It now folds onto the spawn
capsule through the existing `agent_fallback_results` channel. Only
`FINAL_ANSWER` is readable this way: the `MESSAGE` / `NEW_TASK` envelopes
carrying the delegated task are Fernet-encrypted in the child's own rollout
too, and stay redacted.

A `SubAgentActivity` reporting `completed` or `interrupted` was discarded as
noise; it now settles the capsule it belongs to. Live that is an update onto
the launch's own tool call, gated on it still being active — a child outlives
the turn that spawned it, and `upsert_tool_call` would otherwise materialize a
ghost card from an update naming an id already cleared.

Because a codex child's thread id IS its rollout's filename id, a capsule can
open the child's own session through the machinery grok already uses. A
sub-agent rollout replays its parent's history first; those declaring
`subagent_history_start_ordinal` are trimmed to their own turns, and older ones
offering no exact cut are left alone rather than guessed at.

`list_agents` rendered as a wall of escaped JSON despite carrying each finished
child's full report — one of the few readable copies of that text, since the
native team has no `close_agent` and its wait returns only "Wait completed." It
becomes a collab capsule, minus the root row, which is the conversation being
read.

The capsule chrome carries the sub-agent now: its outcome as a chip in the pill,
and "open its session" as a button beside the pill instead of a line of body
text. Both hold their place whether the capsule is expanded, collapsed, or has
no body at all — the live case, where the report has not been written yet and
the capsule was otherwise an empty frame. The wait capsule offers the same
entry for ids that are thread ids; `list_agents` keys its roster by name and
would open nothing.