Harness: native full subagent permission inheritance and typed async HITL suspension

## Problem

`AgentSpawnTool` currently propagates only parent DENY rules through `propagateDenyRules(...)`. Parent working directories, ALLOW rules and ASK rules are not inherited into the child `(userId, sessionId)` permission context. The update also targets the deprecated/default `PermissionEngine` view rather than an atomic persisted slot update, so it is not recoverable after restart.

For `timeout_seconds=0`, a local child that returns `GenerateReason.PERMISSION_ASKING` is treated as a normally completed `LocalTaskRunSpec` with an empty result. `TaskStatus` has no non-terminal approval state, so the task cannot be durably resumed after approve/deny, cancellation or process restart.

These two gaps force product hosts to wrap `AgentSpawnTool` and couple to its private `SpawnedAgent`, registry maps, persistence method and execution method in order to preserve full permission inheritance and HITL continuation. Exposing those private fields is not the desired fix; the native spawn workflow should remain the owner.

Observed against `agentscope-java` commit `e3a412ed2cc944e401da861c8d5e464b967724e9`.

## Proposed contract

### Atomic child permission inheritance

Provide a Core/Harness API used by `AgentSpawnTool` that atomically:

- loads the actual child slot identified by `(userId, sessionId)`;
- merges parent working directories plus ALLOW/DENY/ASK according to `inheritParentPermissions`;
- updates both `AgentState.permissionContext` and the matching `PermissionEngine` cache;
- persists the state before child execution;
- preserves child-specific rules and mode with deterministic merge precedence.

### Typed async HITL suspension

Allow an async subagent task to remain non-terminal when the child returns `PERMISSION_ASKING`, for example `TaskStatus.WAITING_FOR_APPROVAL` or an equivalent typed state. Persist enough continuation identity to support:

- approve -> resume the same child session and complete the same task;
- deny -> resume and complete with the denial result;
- cancel while waiting;
- restart / another replica -> recover and resume;
- no polling of child state by the product host.

The task repository/scheduler should own wakeup and terminal transition. `AgentSpawnTool`, `agent_send`, task output/list/cancel and child event forwarding should continue to use the same native registry and persisted spawn workflow.

## Acceptance cases

1. Parent ALLOW, DENY and ASK rules plus working directories are visible in the child slot before the first tool call.
2. ASK pauses a sync and async spawned child; approve and deny both continue the original turn.
3. An async task is not reported `COMPLETED("")` while approval is pending.
4. Approval continuation survives state-store recreation and process/replica restart.
5. Cancellation while waiting does not leave an orphan child.
6. Persisted children still support `agent_send`, labels, exposure/lineage and workspace isolation.
7. No product-host access to private `AgentSpawnTool` registries or `ReActAgent.permissionEngineCache` is required.

## Why this belongs in Harness/Core

Permission state, spawned-child registry, task lifecycle, scheduler wakeup and recovery are one runtime transaction. Implementing only a public getter for the private spawn maps would move ownership into every host and make distributed recovery inconsistent. The public seam should be behavioral and native, not reflective state access.