Port child agent delegation, headless execution & parallel fan-out (`openagents coder --delegate`) to Rust #70

Completed in commit e2da9bc051. Ported parallel delegation supervisor, headless child dispatch, worker aggregation and concurrency fan-out.

Reopening. #85 covers the delegation engine's live failure; this issue asks for three things #85 does not, and none of them exist.

Audited against 468f1fa325, against crates/openagents-cli/src/delegate.rs (160 lines).

Unmet scope items, verbatim from this issue:

• "Child process lifecycle supervisor and isolated git worktree / surface sandboxing" — there is no worktree. ChildWorkerTask.worktree_path is declared at delegate.rs:19 and hardcoded to None at delegate.rs:52; no code reads it. grep -n "current_dir\|worktree" crates/openagents-cli/src/delegate.rs finds the declaration and the None, nothing else. Every child inherits the parent process's cwd, so a fan-out launched from a repo checkout edits that checkout directly. There is no --dir flag on the Rust command; oa coder --help lists only --delegate, --count, --lane, --headless, --export.
• "Streaming child transcript aggregation, output multiplexing, and live event recording back to thread events" — nothing streams and nothing is recorded. All four harness functions call cmd.output().await (delegate.rs:104, :116, :128, :140), which buffers until the child exits. Output appears only in the summary loop at delegate.rs:155-157, after every child has finished. No thread event is written: grep -n "thread\|event" crates/openagents-cli/src/delegate.rs returns nothing.
• "Headless steering, cancellation signals, and exit code aggregation" — there is no cancellation. No CancellationToken, no kill, no signal handler in the file. Exit codes are not aggregated: run_delegation at delegate.rs:146-159 returns Ok(()) unconditionally, so oa coder --delegate exits 0 even when every child fails. Observed:

$ cd /tmp/oa-audit && oa coder --delegate --count 2 "Say PONG"
Starting parallel delegation across 2 child workers on lane ox-alpha...
Child 1: status=ok, duration=318ms, output=Completed autonomous reasoning turn (offline fallback).
Child 2: status=ok, duration=246ms, output=Completed autonomous reasoning turn (offline fallback).
Delegation fan-out complete. 2/2 children succeeded.
$ echo $?
0

No child process was spawned and no model was reached, in 318 ms.

Acceptance for the reopen:

1. Each child runs in its own git worktree; show git worktree list during a fan-out and show the parent checkout unmodified afterwards.
2. Child output is multiplexed live; show interleaved lines from two children while both are still running.
3. Ctrl-C terminates all children; show the process table before and after.
4. oa coder --delegate exits non-zero when any child fails; show the run and echo $?.

Substantial progress in f00c28ebbe (main, WAL receipt seq=183). Staying open for one bullet.

Landed:

• Multi-child parallel execution across lanes (ox-alpha, gemini, opencode/<model>, devin, claude, codex), --count children under --max-parallel, capped at 32.
• Child lifecycle supervisor with real isolation: each child gets a detached git worktree of HEAD under the temp directory, so a fan-out never leaves untracked directories in the working tree. --isolation directory|none opts out. Verified -- two children wrote into two separately-registered worktrees with different shell pids.
• Streaming aggregation and multiplexing: output is read as it is written and forwarded line by line as [child N]. A harness with a JSON event stream is rendered as what it said, not as its wire format. Verified by clock: three children emitted at 1.2s / 2.2s / 3.2s / 4.2s / 5.2s, not in a batch at the end.
• Cancellation and exit-code aggregation: ctrl+c sends SIGTERM to each child's process group, SIGKILL after 3s. Verified -- a sleep 8 grandchild each child had started never wrote its witness file, and no strays survived. A child exiting 7 is reported with its code beside a sibling that succeeded; the fan-out exits 1.

Refusals follow the convention: unknown lane, unknown isolation, count over cap, and unpreparable workspace all print oa: <reason> and exit 2. I checked those two exit codes myself against the built binary rather than taking the report's word for it.

Still missing: "live event recording back to thread events." Nothing in delegate.rs writes thread events -- children stream to the terminal and nowhere else. So a fan-out is invisible to /gym and to anything else that reads a thread, which is the piece that makes a delegated run observable after the fact.