Preserve delegation isolation inside microVM environments

Parent: #526

Outcome

Subagent, Parallel, and Team execution preserve the existing read-parallel/mutate-serial and parent/child isolation semantics when the parent runs in a microVM.

Scope

• Route EnvironmentForker/EnvironmentMerger by EnvironmentRef kind; never send a microVM environment through the local host-worktree fallback accidentally.
• Direct-write Subagent uses the parent VM/worktree and remains parent-mutate-serial.
• Read-only Subagent, Parallel branches, and Team members receive complete child environments whose Workspace and CommandRunner share the child namespace.
• Define exact parent-state capture when the parent has uncommitted changes.
• Reuse worktree/snapshot strategies without exposing the parent's writable Git metadata.
• Merge additions, replacements, and deletions against the immutable fork base; serialize per parent; preserve child state on conflict.
• Persist child environment refs/parentage so daemon crashes cannot leak or cross-attach children.
• Apply child/fork quotas consistently with existing Subagent/Team concurrency gates.

Acceptance

• Direct-write changes appear in the parent worktree/VM only.
• Read-only and mutating child environments cannot modify the parent before an authorized merge.
• Child Bash and filesystem tools always target the same child namespace.
• Concurrent branches do not share writable worktrees, Git administrative state, runner endpoints, or environment generations.
• Conflict results preserve inspectable child state and never partially apply an uncertain merge.
• Cancellation, timeout, background-child drain, and resume retain their existing observable semantics.