[Mabolla]

What does this PR do?

Opted-in ACP clients receive ID-addressed subagent lifecycle and progress updates, with stable child IDs and immediate-parent associations. Parent controls remain available; announced child sessions advertise no mutations and reject child-directed control requests before any gateway lookup.

Fixes #137069. Implements the merged ACP subagents RFD #1992.

Gateway migration

Rebased onto main 7520c4e8b3791f081b2c26d5ea9a0c07b0363401. Normal HermesACPAgent() construction selects GatewayACPAgent. TurnRunner now publishes the bounded lifecycle fields through its generation-fenced canonical stream, and the ACP event pump projects those events. In particular, subagent completion is published before the pre-existing completion-notice branch returns.

The explicitly injected SessionManager adapter remains covered too. Nested delegate relays preserve child and parent identity instead of relabelling nested events.

The pinned SDK 0.9.0 predates this variant. Public initialization observer and sender-factory hooks retain the raw capability and queue the additive update through the same ordered sender. Only object-valued clientCapabilities.subagents (including {}) opts in; absent/null/boolean values do not. No dependency bump, schema monkeypatch or new private SDK access.

Scope

Lifecycle/progress only, no child transcript or reasoning. The wire update uses the immediate parent as outer sessionId, a stable child sessionId inside subagent_update, and state running/idle/unknown. Completed/interrupted children report end_turn/cancelled; timed-out workers remain unknown.

Main currently disables delegation in managed workers. This PR does not enable an unsupported execution path; it projects delegation where the existing execution owner already supports it.

Validation

Linux, Python 3.14.7, ACP SDK 0.9.0:

• 138 passed across 14 distinct files in the current selected suites.
• Default gateway implementation, real SessionEvents ordering and SDK TCP JSON-RPC transport: opt-in controls, nested parentage, stable IDs, terminal states and early rejection of all child mutation methods.
• Actual TurnRunner callback publishes start and completion even when the existing completion notice returns early.
• Legacy adapter tests use the actual delegate relay at the model-execution boundary.
• Existing ACP/session/permission/edit/entry/provenance regressions.
• RED with unchanged main gateway projection: supported client receives zero subagent updates; two unsupported-client controls pass.
• 12 blocking checks passed, zero health findings; whitespace clean.
• Remote tree matches the tested staged tree.

Use a fresh PM dev/test environment with --extra acp and run the relevant files through scripts/run_tests.sh.

Live GUI/model-backed delegation, paid provider calls and native Windows/macOS validation remain unclaimed.

Native Linux cloud validation

GitHub Actions job checked out exact PR head 7e94d5f8403c56396e3b24a4c37d7efbd420a204 on ubuntu-latest, Python 3.14.7. Unix socket support was verified before running the full ACP suite plus managed-worker construction/tool-event and local-viewer event/status regressions through scripts/run_tests.sh with file retries disabled.

374 tests passed, 0 failed, 1 Windows-only test skipped, across 80 files. Real daemon/Unix-control-socket and ACP stdio integration cases passed. Full logs are attached to the run as acp-daemon-137380.