Add a toolPolicy parameter to sessions_spawn that allows the parent agent
to restrict the tool set available to spawned sub-agents.
The new toolPolicy parameter accepts allow and deny arrays:
- allow: Narrows the sub-agent to only these tools (on top of default deny list)
- deny: Additional tools/groups to block (appended to default deny list)
Supports tool group syntax (group:web, group:fs, group:runtime, etc.)
Implementation:
- SessionEntry gains spawnToolPolicy field (persisted per-session)
- sessions.patch accepts spawnToolPolicy for subagent sessions
- Policy is immutable once set (cannot be changed after spawn)
- Merges with existing default subagent deny list
- Applied in both embedded agent path and HTTP tool invoke path
