feat(runtime): add bounded foreground ad hoc child route

[bug-superman]

Summary

Implements the bounded foreground ad hoc child-agent slice for #4538:

• adds a desktop setting for an explicitly enabled temporary child-agent policy, including the maximum profile and model connection/model/thinking-level selection;
• exposes the synthetic temporary-bounded route through the existing agent_list/agent_spawn catalog path only when enabled and its host-resolved model connection is available;
• preserves an existing ad hoc policy when ordinary presets are updated;
• accepts only bounded task-scoped role text, while Runtime/Host continue to select the profile, model, tools, permission, workspace, lifecycle, and nesting authority;
• rejects model-supplied overreach (model, connection, tools, permission, workspace, lifecycle/nesting, write-back/isolation, and a second profile selector);
• rejects invalid role data, nested creation, graph/background use, unavailable routes, and over-broad contract requests before child Session creation;
• preflights the temporary child against the parent Session execution boundary;
• preserves the existing linked Session/AgentRun lineage, idempotency, cancellation, recovery, transcript isolation, and artifact paths;
• extracts shared synthetic-preset construction and adds focused coverage.

UI evidence

Before (ad hoc policy controls absent):

After (ad hoc policy controls visible):

Verification

• npm run build --workspace @maka/core
• npm run build --workspace @maka/storage
• npm run build --workspace @maka/runtime
• npm run build --workspace @maka/runtime-host
• Renderer TypeScript check
• focused Runtime/Runtime Host tests and 772 Core tests passing
• biome check and git diff --check

The full Runtime suite still has nine unrelated pre-existing dependency/timing failures.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex provided material implementation and review assistance; the commits retain Generated-by: OpenAI Codex trailers.

Closes #4538

[bug-superman]

Closing this PR to resubmit from the requested testikun GitHub account.