fix(delegation): clear senderID in sync delegation context

Sync delegations inherited the caller's senderID, causing the delegate
agent to check group writer permissions against its own (empty) writer
list instead of bypassing like async delegations do. This resulted in
"permission denied: only file writers can modify files" errors when
delegate agents tried to write files.

Fix: clear senderID from the sync delegation context so it behaves
consistently with async delegations (context.Background has no
senderID). All 4 downstream usages of SenderIDFromContext are
group-writer-related and correctly bypass when senderID is empty.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/tools/delegate.go

@@ -184,10 +184,13 @@ func (dm *DelegateManager) Delegate(ctx context.Context, opts DelegateOpts) (*De
 	dm.emitEvent("delegation.started", task)
 	slog.Info("delegation started", "id", task.ID, "target", opts.TargetAgentKey, "mode", "sync")
 
-	// Propagate parent trace ID so the delegate trace links back
-	delegateCtx := ctx
+	// Propagate parent trace ID so the delegate trace links back.
+	// Clear senderID — delegations are system-initiated, the delegate agent
+	// should not inherit the caller's group writer permissions (the delegate
+	// agent has its own writer list, and would incorrectly deny writes).
+	delegateCtx := store.WithSenderID(ctx, "")
 	if parentTraceID := tracing.TraceIDFromContext(ctx); parentTraceID != uuid.Nil {
-		delegateCtx = tracing.WithDelegateParentTraceID(ctx, parentTraceID)
+		delegateCtx = tracing.WithDelegateParentTraceID(delegateCtx, parentTraceID)
 	}
 
 	startTime := time.Now()