fix(collaboration): harden delegated task isolation (#1486)

* feat(collaboration): isolate delegated artifacts and child runs

Isolate delegated inputs and outputs behind secure artifact exchange lifecycles. Scope Agent Link tasks by tenant and root agent, and enforce delegation spawn-tree boundaries. Add process-wide child-run admission and preserve logical media paths across native, MCP, and sandbox execution.

* fix(collaboration): harden delegated task isolation

Enforce tenant and root-agent task scope across migrations and stores. Add exactly-once async completion delivery, delegated sandbox boundaries, and confined artifact and media recovery across runtime surfaces.

* fix(collaboration): recover interrupted async tasks

* fix(collaboration): normalize persisted child-run status

---------

Co-authored-by: ntduc <ntduc@cpp.ai.vn>

internal/sandbox/docker_cache_key_test.go

@@ -1,6 +1,9 @@
 package sandbox
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestDockerCacheKeyIncludesWorkspaceAndConfig(t *testing.T) {
 	cfg := DefaultConfig()
@@ -28,3 +31,37 @@ func TestDockerCacheKeyPreservesEmptyWorkspaceCompatibility(t *testing.T) {
 		t.Fatalf("dockerCacheKey empty workspace = %q, want original key %q", got, key)
 	}
 }
+
+func TestDockerCacheKeyDoesNotExposeMountRoots(t *testing.T) {
+	cfg := DefaultConfig()
+	hostRoot := "/sensitive/runtime/delegation/inputs"
+	got := dockerCacheKey(
+		"delegation:9db9",
+		"/sensitive/runtime/delegation/outputs",
+		cfg,
+		ReadOnlyMount{
+			Name:        "inputs",
+			HostPath:    hostRoot,
+			Destination: "/workspace/inputs",
+		},
+	)
+
+	if strings.Contains(got, "/sensitive/") || strings.Contains(got, hostRoot) {
+		t.Fatalf("dockerCacheKey exposed mount root: %q", got)
+	}
+}
+
+func TestDockerCacheKeyIncludesDelegationIdentity(t *testing.T) {
+	cfg := DefaultConfig()
+	mount := ReadOnlyMount{
+		Name:        "inputs",
+		HostPath:    "/runtime/inputs",
+		Destination: "/workspace/inputs",
+	}
+
+	first := dockerCacheKey("delegation:first", "/runtime/outputs", cfg, mount)
+	second := dockerCacheKey("delegation:second", "/runtime/outputs", cfg, mount)
+	if first == second {
+		t.Fatalf("dockerCacheKey reused identity across delegation keys: %q", first)
+	}
+}