Allow read-only subagents during plan mode

[ralphschuler]

Summary

Allow subagents during /plan while enforcing read-only child-agent execution before plan approval.

Changes

• Add shared plan-mode read-only state for subagent execution.
• Set and clear subagent plan-mode state from the /plan workflow.
• Block subagent action=create, subagent action=delete, and subagent output file writes while planning is active because they write/remove local files.
• Allow subagent list, run, and parallel during planning, with read-only execution constraints for child runs.
• Spawn plan-mode child Pi processes with --tools read,grep,find,ls.
• Inject child prompt instructions forbidding edits, writes, implementation, commits, package installs, server starts, and git state mutation.
• Remove temporary subagent prompt files after child execution.
• Document plan-mode subagent safety behavior.
• Add/update tests for plan-mode gating, read-only child command construction, and live-output spawn expectations.

Validation

node --test tests/unit/plan-extension.test.mjs tests/unit/subagent-modules.test.mjs tests/unit/live-output-extension.test.mjs
npm run check

Result: all passed.

Skipped/blocked:

npm run docs:build
# mkdocs: not found

Risks/Rollback

Risk: read-only child enforcement depends on child Pi honoring --tools read,grep,find,ls. The parent /plan guard also blocks custom agent creation/deletion and subagent output writes before approval to close hidden write paths.

Rollback: revert this PR to restore previous subagent execution behavior during /plan.

Related Issues

Closes #58

Conversation Context

Selected issue #58 as the highest-priority actionable security issue after issue #68 was merged. Implementation followed behavior-first vertical slices: plan-mode subagent action gating, read-only child process command construction, prompt constraints, tests, then docs. Follow-up review found subagent action=create was a hidden pre-approval write path, so this PR now blocks it during /plan to preserve the read-only safety contract.