Add AgentSpec, three guardrail ports, subagent events, and ask passthrough

Why: N1 increment three (WP1/WP4) - agents need a canonical spec
format with plugin restrictions, hosts need typed input/output/tool
guardrails, delegation needs lifecycle events, and squad adapters
need to pass the permission ask port through.

Evidence: go vet clean; go test ./... 26 packages ok, including new
agentspec (12 tests), guardrails (5), loop_guardrails (5), and
subagent hook tests (3).

Impact: new runtime/agentspec and runtime/guardrails packages; loop
consumes UserPromptSubmit outcomes (deny skips the loop, modify
appends the rewrite); subagent gains RegisterWithHooks emitting
SubagentStart/Stop around delegation; GateOptions gains PermissionAsk
forwarded into the kernel config. All additions are opt-in: nil
ports preserve prior behavior exactly.

Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP1/WP4

runtime/loop.go

@@ -204,7 +204,27 @@ func Run(ctx context.Context, cfg Config, user llm.Message) (Result, error) {
 	messages = append(messages, user)
 	emit(cfg, Event{Type: "agent_start"})
 	cfg.Hooks.Emit(hooks.Call{Event: hooks.SessionStart})
-	cfg.Hooks.Emit(hooks.Call{Event: hooks.UserPromptSubmit, LastText: user.Content})
+	if out := cfg.Hooks.Emit(hooks.Call{Event: hooks.UserPromptSubmit, LastText: user.Content}); out.Decision != "" {
+		switch out.Decision {
+		case hooks.Deny, hooks.Block:
+			// 输入护栏拒绝：不进入循环，以理由直接收尾（原文已持久化留痕）。
+			why := out.Reason
+			if why == "" {
+				why = "输入被护栏拒绝"
+			}
+			return Result{Text: why, Messages: messages, StopReason: llm.StopEnd, Notice: why}, nil
+		case hooks.Modify:
+			// 改写后的输入追加为新的用户消息（原文保留，可审计）。
+			if out.Replacement != "" {
+				note := llm.Message{Role: llm.RoleUser, Content: out.Replacement}
+				if err := persist(cfg, note); err != nil {
+					return Result{}, err
+				}
+				messages = append(messages, note)
+				user = note
+			}
+		}
+	}
 
 	var last llm.Message
 	var usage llm.Usage