fix(tool): require task_id to descend from the calling session

[filipeforattini]

Problem

packages/redcode/src/tool/task.ts accepted any task_id and prompted into sessions.get(task_id) with no check that the session was a child (or descendant) of the calling session. The subagent depth cap was computed on the caller rather than on the resumed chain, so a model could pass a sibling or a top-level session id from another project and drive it under the subagent ruleset. Separately, the background cap counted every running task job for the session, so a foreground task waiting on its turn blocked background launches.

Fix

• Load the resumed session first and walk its parentID chain; fail with task_id <id> must reference a subagent session started from this session unless ctx.sessionID appears in it. Passing the caller's own id is refused for the same reason.
• Measure subagent_depth on the chain that is actually prompted (the resumed session's ancestors, or the caller's ancestors plus the new child). The fresh-child path is unchanged in effect.
• Count only jobs with metadata.background === true toward background_subagents_max. Promoted foreground jobs already carry that flag, so they are still counted.

Test

packages/redcode/test/tool/task.test.ts adds three tests:

• execute refuses a task_id that did not descend from the calling session (foreign top-level, foreign child, and own session id)
• execute caps depth on the resumed chain, not on the caller
• a running foreground task does not count against the background cap

With the source change stashed, exactly those three fail and the remaining 22 pass (the existing execute resumes an existing task session from task_id stays green). With the fix, 25/25 pass. bun run typecheck in packages/redcode is clean.

https://claude.ai/code/session_01KAcoL6wpgVEs2ebUrUGpHS

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}