feat(orchestration,loop,flow): 接线子代理编排 — 派发入口 + 分支归父会话 + 节点日志（含脱敏）

修的是「文档说 ✅、生产不可达」：此前 Scheduler.Spawn 只有测试调用方、无 bus 入口、无派发工具；Span.Record 无生产调用方 → 泳道画不出、节点日志恒空。
- 入口：subagent_spawn 工具（internal/runtime/orchestration/spawntool.go，同包便于用真 Scheduler/loop/Tracer/Flow 做集成测试；注册在 cmd/cyrene/subagent_tool.go 照 terminal_tool 范式）。默认 owner-only，不设 AllowInGroup/AllowInStranger；安全仍由 restrictSchemas + applyToolSecurityGate 双层保证，未绕代审
- 父会话归属：AgentSpec.ParentSession（请求语义）→ Scheduler 转运行期 ctx 标记 loop.WithFlowBranch → 分支 span 以父 session 发布；**allow 谓词一行未改**；单图语义靠「分支 Run 不调 StartRound/EndRound」+ FlowPublisher 不新建图；未归属 spawn 一张图都不发（有测试锁）
- 前台最多等 2s（对齐 task.autoBackgroundThreshold）→ 合并结果作工具结果；转后台则广播 bus subagent.result（design/05 §9 回填 hook）；新增 Scheduler.Wait(ids) 按批等待（Join 会串并发批次，故不重用）
- 子代理跑在 WithoutCancel(ctx)：保留 span 归属、不被工具超时/回合结束顺手杀掉；生命周期由 PerAgentTimeout + CancelAll 约束；内部 WithMutedBroadcast 静音（不进前台 stream）
- 节点日志：loop/spanlog.go 新增 llm.done / tool.done / subagent.done；工具参数**只记键名不记值**；仅步骤真正结束才追加（跳过/被拒路径不发，不伪造）
- 脱敏（红线）：新增 trace/redact.go（形状规则 sk-/Bearer/JWT/key:value + 键名规则 api_key/token/authorization/password…，递归嵌套、不改调用方事件），graph.go 发布前必经；**顺带修掉一个既有泄漏**：result_summary prop 原先未脱敏（工具结果里的密钥会进图），由图级变异测试抓出
- 测试：新增 22 个（工具级 / 图级 / 日志级），含 4 次变异验证（去掉 WithFlowBranch、去掉 record*、还原未脱敏、去掉静音 各自 FAIL）；-race 过 orchestration+trace+loop
- 已知限制：真实模型端到端未验（无凭据/不起服务）；工具白名单是 design gap 未做；subagent.result 暂无消费者（design/15 未实现）；后台子代理跨轮次边界迟到 span 会丢泳道根；PerAgentTimeout=10min 待确认

internal/runtime/trace/graph.go

@@ -256,11 +256,12 @@ func (g *RunGraph) addEdge(from, to string) {
 }
 
 // SeedInput creates the "input" node for the round. It returns the node id so a
-// caller can reference it.
+// caller can reference it. The label is redacted (design/19 §3), so a message that
+// happens to carry a credential cannot publish one.
 func (g *RunGraph) SeedInput(text string) string {
 	g.Upsert(NodeSpec{
 		ID:        "input",
-		Label:     truncate(text, maxSummaryRunes),
+		Label:     RedactText(text),
 		Kind:      "input",
 		Status:    FlowStatusDone,
 		StartedAt: g.started,
@@ -269,12 +270,12 @@ func (g *RunGraph) SeedInput(text string) string {
 }
 
 // SeedOutput creates the "output" node for the round, wired to the last node so
-// the trunk ends at the answer.
+// the trunk ends at the answer. The label is redacted like SeedInput's.
 func (g *RunGraph) SeedOutput(text string) string {
 	g.ended = time.Now()
 	g.Upsert(NodeSpec{
 		ID:        "output",
-		Label:     truncate(text, maxSummaryRunes),
+		Label:     RedactText(text),
 		Kind:      "output",
 		Status:    FlowStatusDone,
 		StartedAt: g.ended,
@@ -300,7 +301,7 @@ func (g *RunGraph) AddSpan(rec SpanRecord) {
 		StartedAt: rec.StartedAt,
 		EndedAt:   rec.EndedAt,
 		Props:     safeSpanProps(rec),
-		Log:       rec.Events,
+		Log:       redactEvents(rec.Events),
 		ParentID:  rec.ParentID,
 	})
 }
@@ -392,8 +393,9 @@ func labelForStart(name string, kind SpanKind) string {
 }
 
 // safeSpanProps carries only a whitelist of span props to the frontend, plus a
-// desensitized tool result summary. It never forwards raw arguments or secrets,
-// and truncates string text so long content cannot leak a full sensitive payload.
+// desensitized tool result summary. It never forwards raw arguments or secrets, and
+// every string is scrubbed of credential shapes and truncated, so long or sensitive
+// content cannot leak a full payload (design/19 §3).
 func safeSpanProps(rec SpanRecord) map[string]any {
 	var props map[string]any
 	for _, k := range safePropKeys {
@@ -411,21 +413,12 @@ func safeSpanProps(rec SpanRecord) map[string]any {
 			if props == nil {
 				props = make(map[string]any)
 			}
-			props["result_summary"] = truncate(summarize(v), maxSummaryRunes)
+			props["result_summary"] = RedactText(summarize(v))
 		}
 	}
 	return props
 }
 
-// redactValue shortens string props so a long error/step value cannot leak
-// sensitive content through the dashboard; non-string values pass through.
-func redactValue(v any) any {
-	if s, ok := v.(string); ok {
-		return truncate(s, maxSummaryRunes)
-	}
-	return v
-}
-
 // safePropKeys are the span prop keys forwarded to a node's props.
 var safePropKeys = []string{"stop_reason", "step", "error", "error_kind", "tool"}