feat(orchestration,loop,flow): 接线子代理编排 — 派发入口 + 分支归父会话 + 节点日志（含脱敏）

修的是「文档说 ✅、生产不可达」：此前 Scheduler.Spawn 只有测试调用方、无 bus 入口、无派发工具；Span.Record 无生产调用方 → 泳道画不出、节点日志恒空。
- 入口：subagent_spawn 工具（internal/runtime/orchestration/spawntool.go，同包便于用真 Scheduler/loop/Tracer/Flow 做集成测试；注册在 cmd/cyrene/subagent_tool.go 照 terminal_tool 范式）。默认 owner-only，不设 AllowInGroup/AllowInStranger；安全仍由 restrictSchemas + applyToolSecurityGate 双层保证，未绕代审
- 父会话归属：AgentSpec.ParentSession（请求语义）→ Scheduler 转运行期 ctx 标记 loop.WithFlowBranch → 分支 span 以父 session 发布；**allow 谓词一行未改**；单图语义靠「分支 Run 不调 StartRound/EndRound」+ FlowPublisher 不新建图；未归属 spawn 一张图都不发（有测试锁）
- 前台最多等 2s（对齐 task.autoBackgroundThreshold）→ 合并结果作工具结果；转后台则广播 bus subagent.result（design/05 §9 回填 hook）；新增 Scheduler.Wait(ids) 按批等待（Join 会串并发批次，故不重用）
- 子代理跑在 WithoutCancel(ctx)：保留 span 归属、不被工具超时/回合结束顺手杀掉；生命周期由 PerAgentTimeout + CancelAll 约束；内部 WithMutedBroadcast 静音（不进前台 stream）
- 节点日志：loop/spanlog.go 新增 llm.done / tool.done / subagent.done；工具参数**只记键名不记值**；仅步骤真正结束才追加（跳过/被拒路径不发，不伪造）
- 脱敏（红线）：新增 trace/redact.go（形状规则 sk-/Bearer/JWT/key:value + 键名规则 api_key/token/authorization/password…，递归嵌套、不改调用方事件），graph.go 发布前必经；**顺带修掉一个既有泄漏**：result_summary prop 原先未脱敏（工具结果里的密钥会进图），由图级变异测试抓出
- 测试：新增 22 个（工具级 / 图级 / 日志级），含 4 次变异验证（去掉 WithFlowBranch、去掉 record*、还原未脱敏、去掉静音 各自 FAIL）；-race 过 orchestration+trace+loop
- 已知限制：真实模型端到端未验（无凭据/不起服务）；工具白名单是 design gap 未做；subagent.result 暂无消费者（design/15 未实现）；后台子代理跨轮次边界迟到 span 会丢泳道根；PerAgentTimeout=10min 待确认

internal/runtime/orchestration/subagent.go

@@ -11,12 +11,12 @@ import (
 )
 
 // SubAgent is a single spawned sub-agent instance. The identity fields (ID, Goal,
-// RoleID, Mode, AttachInfo, Data, Context, WorkingMemory) are set once at Spawn
-// and never mutated. The lifecycle fields (Status, Summary, Result, Err) are
-// written by the sub-agent's background goroutine and read through the
+// RoleID, Mode, AttachInfo, ParentSession, Data, Context, WorkingMemory) are set
+// once at Spawn and never mutated. The lifecycle fields (Status, Summary, Result,
+// Err) are written by the sub-agent's background goroutine and read through the
 // synchronized accessors below, so reading them before the sub-agent finishes is
 // safe. A sub-agent is terminal exactly once its Done reports true; Join returns
-// once every sub-agent is terminal.
+// once every sub-agent is terminal, Wait once the named ids are.
 //
 // SubAgent is created by (*Scheduler).Spawn; it should not be built directly.
 type SubAgent struct {
@@ -30,6 +30,9 @@ type SubAgent struct {
 	Mode string
 	// AttachInfo is the free-form attachment text supplied at spawn.
 	AttachInfo string
+	// ParentSession is the session whose flow graph owns this sub-agent's branch
+	// (blank when the branch is not visualized).
+	ParentSession string
 	// Data is the optional structured payload supplied at spawn.
 	Data any
 	// Context is the isolated conversation context. It is a deep copy of the
@@ -52,6 +55,10 @@ type SubAgent struct {
 	abortReq   bool
 	doneClosed bool
 
+	// finishedCh is closed exactly once when the sub-agent reaches a terminal
+	// state, so Wait can block per-id without polling.
+	finishedCh chan struct{}
+
 	launchOnce sync.Once
 	finishOnce sync.Once
 }
@@ -106,6 +113,14 @@ func (s *SubAgent) FinishedAt() time.Time {
 // Done reports whether the sub-agent reached a terminal state.
 func (s *SubAgent) Done() bool { return s.Status().Terminal() }
 
+// waitDone returns the channel closed when the sub-agent reaches a terminal
+// state. It is what (*Scheduler).Wait blocks on, per-id, without polling.
+func (s *SubAgent) waitDone() <-chan struct{} { return s.finishedCh }
+
+// markFinished closes the completion channel exactly once. It is called from
+// finish under finishOnce, so a sub-agent wakes every Wait caller exactly once.
+func (s *SubAgent) markFinished() { close(s.finishedCh) }
+
 // Snapshot returns a point-in-time copy of the sub-agent's state, safe to read
 // while the sub-agent is still running.
 func (s *SubAgent) Snapshot() SubAgentResult {