fix(collaboration): harden delegated task isolation (#1486)

* feat(collaboration): isolate delegated artifacts and child runs

Isolate delegated inputs and outputs behind secure artifact exchange lifecycles. Scope Agent Link tasks by tenant and root agent, and enforce delegation spawn-tree boundaries. Add process-wide child-run admission and preserve logical media paths across native, MCP, and sandbox execution.

* fix(collaboration): harden delegated task isolation

Enforce tenant and root-agent task scope across migrations and stores. Add exactly-once async completion delivery, delegated sandbox boundaries, and confined artifact and media recovery across runtime surfaces.

* fix(collaboration): recover interrupted async tasks

* fix(collaboration): normalize persisted child-run status

---------

Co-authored-by: ntduc <ntduc@cpp.ai.vn>

internal/orchestration/child_run_admission.go

@@ -0,0 +1,33 @@
+package orchestration
+
+import "github.com/nextlevelbuilder/goclaw/internal/childrun"
+
+var (
+	ErrChildRunBusy                = childrun.ErrChildRunBusy
+	ErrChildRunClosed              = childrun.ErrChildRunClosed
+	ErrChildRunDrainTimeout        = childrun.ErrChildRunDrainTimeout
+	ErrChildRunInvalidContinuation = childrun.ErrChildRunInvalidContinuation
+	ErrChildRunContinuationDepth   = childrun.ErrChildRunContinuationDepth
+)
+
+type ChildRunState = childrun.ChildRunState
+
+const (
+	ChildRunNew          = childrun.ChildRunNew
+	ChildRunQueued       = childrun.ChildRunQueued
+	ChildRunRunning      = childrun.ChildRunRunning
+	ChildRunWaitingChild = childrun.ChildRunWaitingChild
+	ChildRunCompleted    = childrun.ChildRunCompleted
+	ChildRunFailed       = childrun.ChildRunFailed
+	ChildRunCancelled    = childrun.ChildRunCancelled
+)
+
+type ChildRunConstraints = childrun.ChildRunConstraints
+type ChildRunStats = childrun.ChildRunStats
+type ChildRunAdmission = childrun.ChildRunAdmission
+type ChildRunTicket = childrun.ChildRunTicket
+type ChildRunLease = childrun.ChildRunLease
+
+func NewChildRunAdmission(processLimit, pendingLimit int) *ChildRunAdmission {
+	return childrun.NewChildRunAdmission(processLimit, pendingLimit)
+}