Subagents bypass the parent approval mode

**Describe the bug**

A subagent created by the Summon extension does not preserve an approval-requiring mode from its parent session. The child runs in automatic mode, and action-required messages produced by the child do not reach the surface that is driving the parent.

This lets subagent tool calls bypass the approval policy selected for the parent. It is especially visible through ACP clients, where the user receives no permission request for the child tool call.

---

**To Reproduce**
Steps to reproduce the behavior:
1. Start a Goose session through an ACP client.
2. Select a mode that requires approval for sensitive tool calls.
3. Enable the Summon extension.
4. Ask the parent agent to delegate work that requires an approval-gated tool, such as a shell or file-edit operation.
5. Observe that the child tool call runs without an approval request reaching the ACP client.

---

**Expected behavior**
A subagent should preserve the parent session's approval policy. If the child produces an action-required message, the surface driving the parent should receive it, and the response should return to the correct child request.

Concurrent parent and child sessions must not cause confirmation responses to be routed to the wrong request.

---

**Screenshots**
Not applicable.

---

**Please provide the following information**
- **OS & Arch:** All supported platforms
- **Interface:** ACP; the underlying behavior is not ACP-specific
- **Version:** `main` at `f9176266ee2974cdcab0a4938152b6899e2fc18f`
- **Extensions enabled:** Summon and an approval-gated tool extension
- **Provider & Model:** Any tool-capable provider and model

---

**Additional context**
#5140 and #5139 reported related behavior in older subagent implementations, but were resolved by disabling subagents outside autonomous mode. They do not cover preserving the parent mode and forwarding child approval requests in the current Summon implementation.

#11539 describes the new subagent state-machine design and says child sessions carry an execution mode, but it does not define how child action-required messages reach the parent surface or how responses route back.

#11739 is related confirmation-routing work. This bug also requires request correlation across parent and child sessions.

No diagnostics zip is attached because this report describes a deterministic code-path behavior reproduced against the cited `main` revision.