[FEATURE] Agent(agent_type) allowlist in tools has no effect inside a nested subagent definition

## Summary
Inside a custom subagent definition, `tools: Agent(inner)` does not restrict which subagent types that subagent can spawn. The type list is accepted but ignored, so the only way to give a named subagent spawning ability is unrestricted spawning. There is no way to declare a per-subagent spawn allowlist.

## Environment
Claude Code 2.1.259, macOS 15 (Darwin 25.1.0), subscription auth, `claude -p --agents` with inline definitions (same result with `~/.claude/agents/*.md`).

## Reproduction
`agents.json`:
```json
{"outer_typed":{"description":"probe","tools":["Read","Agent(inner)"],"model":"haiku",
"prompt":"When asked: call Agent with subagent_type inner, then call Agent with subagent_type other. Report both results."},
"inner":{"description":"probe","tools":["Read"],"model":"haiku","prompt":"Reply PONG-INNER."},
"other":{"description":"probe","tools":["Read"],"model":"haiku","prompt":"Reply PONG-OTHER."}}
```
```
claude -p --model haiku --setting-sources '' --agents "$(cat agents.json)" \
"Spawn the agent named outer_typed with the prompt 'do your probe now', wait for it, return its report."
```
Observed: both nested spawns succeed. The subagent transcripts show `Agent{subagent_type: inner}` and `Agent{subagent_type: other}` tool calls from `outer_typed`, and both children replied. Expected: the `other` spawn is refused, as it is when the same `Agent(inner)` rule is applied to the main thread.

Control: a session-wide `permissions.deny: ["Agent(other)"]` passed via `--settings` DOES refuse the nested spawn ("Agent type 'other' has been denied by permission rule 'Agent(other)' from flagSettings"), so the deny path reaches nested calls; only the per-subagent allowlist does not.

## Docs
code.claude.com/docs/en/sub-agents.md states this as current behaviour: "The `Agent(agent_type)` allowlist syntax applies only to an agent running as the main thread with `claude --agent`. In a subagent definition, listing `Agent` in `tools` lets that subagent spawn subagents of its own while the depth limit allows it, but any type list inside the parentheses is ignored." No rationale is given.

## Why it matters
Nested spawning is on by default (depth 3 since 2.1.219). An orchestrator persona that should only fan out to, say, `worker` and `researcher` can today spawn any type at any model tier. The only per-subagent enforcement available is a `PreToolUse:Agent` hook that reads the caller's `agent_type` and re-implements the allowlist check that the frontmatter already expresses.

## Request
Honour `Agent(type, ...)` in a subagent definition the same way it is honoured for the main thread (allowlist; other types fail with the existing denial message), or document the reason it cannot be.

Start by reproducing the nested-spawn behavior with the inline agents.json definition and the claude -p --agents command from the issue. Read code.claude.com/docs/en/sub-agents.md to confirm the documented semantics, then trace how Agent(inner) is enforced for the main thread versus nested subagents. Done means inner remains allowed, other is refused with the existing denial message, and the session-wide permissions.deny behavior still works.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.