Add real multi-agent specialist team example

[yanpgwang]

Problem

Mango documents multi-agent primitives but lacks a runnable public-HTTP user journey that proves a real coordinator, ordinary specialists, Advisor usage, and persistent child-Thread follow-up together. A real run also needs to expose runtime defects instead of hiding them behind fake model output.

Solution

• add an interactive release-readiness example derived from the public CMA specialist-team user problem, using only Mango HTTP resources and synthetic facts
• verify two ordinary child Threads, one automatically terminated Advisor Thread, real per-Thread token usage, a synthesis barrier, and follow-up on the same reliability Thread
• keep model credentials in the worker and remove provider configuration from the example client process
• document the example, capability evidence, and adopted/changed/rejected CMA design provenance
• fix Messages serialization so every tool_use block emits required input: {} even when the internal map is nil or empty
• atomically terminate and fence persistent child Threads when a primary coordinator turn terminates, including lifecycle events, queued-input/pending-action closure, and durable Workflow termination intents

Acceptance evidence

Ran scripts/with-dev-env make demo-multi-agent-team with claude-sonnet-4-5-20250929 and typed the follow-up constraint in the terminal. The successful run produced real usage on the primary, both specialists, and Advisor; reused the original reliability Thread; created no second Advisor or specialist Thread; printed Verified; and deleted the Session afterward.

The first live attempt exposed the empty tool_use.input adapter bug. A later diagnostic run exposed that a child could finish after primary termination. Both fixes are general runtime behavior with regression tests; there is no scenario-specific runtime branch.

Tests

• make verify
• make docs-check
• make security
• make local-config
• make test-service
• scripts/with-dev-env make demo-multi-agent-team with terminal follow-up
• local mango:local entrypoint smoke and healthy API/worker stack

make image-smoke could not rebuild the image because Docker Desktop had no route to registry-1.docker.io while resolving docker/dockerfile:1.7. The same checkout was cross-compiled into the existing local image; docker run --rm mango:local serve -h, Compose health, and the full real-model journey all passed.

API, migration, and security impact

No public HTTP schema or database migration changes. The existing terminal Session semantics are strengthened so a terminated primary cannot leave persistent children consuming work or publishing late reports. Provider credentials remain worker-only and are neither printed nor persisted by the example client. External scenario data is synthetic; there is no simulated service presented as a real integration.

[yanpgwang]

Follow-up review fix: terminal Session/Thread transitions now fence their active execution journals in the same PostgreSQL transaction. Active attempts become interrupted, started result-less steps become ambiguous, prepared steps cannot cross the side-effect boundary, and delayed EnsureAttempt calls lock and reject terminal owners. Added regressions for active/prepared/started child work and post-termination attempt admission. No public API or migration change.