feat(herdr): add bounded child agent panes

[Bloh09]

Intent

Get the bounded child-panes landing PR green on the captain's fork (Bloh09/firstmate) by carrying the existing feature branch through the real no-mistakes pipeline.

Context and constraints:

• origin is the captain-owned fork Bloh09/firstmate. The upstream remote kunchenguid/firstmate is read-only context: never open, update, or target a PR there.
• Existing hand-opened PR feat(herdr): land bounded child agent panes #1 failed only the "PR must be raised via no-mistakes" check because it was opened by hand without the pipeline signature. Do NOT hand-paste the marker or hand-edit the PR body; the real pipeline must stamp it.
• Feature content is already built: bin/fm-child.sh, bounded-child-agents skill, Herdr backend + teardown integration, docs, e2e tests. Work is verification/rebase, not re-authoring.
• Branch was rebased onto current origin/main while preserving child-pane behavior and main's later muse/presentation/mode contracts. Test fixture fixes after rebase: canonicalize macOS temp realpaths for parent discovery, isolate Kimi HOME fallback from host PATH kimi, and pass required ship delivery contract into the raw supported-harness spawn case.
• Review decision review-1 already applied: keep fail-closed; --force must NOT bypass unreachable-Herdr or unsafe-children-path child teardown gates; document that intentional boundary (landed in prior pipeline review fix commit).
• Prior pipeline commits already landed: review docs/diagnostics/dedupe, and test fix prepending guard PATH in child launch command for macOS.
• If the pipeline opens a NEW PR instead of updating PR feat(herdr): land bounded child agent panes #1, close PR feat(herdr): land bounded child agent panes #1 as superseded with a one-line comment linking the replacement.
• Acceptance: one open PR on Bloh09/firstmate targeting main carrying the complete child-panes work, the no-mistakes signature present in its body, and all checks green.

What Changed

• Add a bounded child-agent lifecycle for Herdr workers, supporting up to three same-tab panes with explicit, disjoint path ownership and inherited harness profiles.
• Enforce guarded child permissions, readiness checks, delivery confirmation, and fail-closed teardown while preserving shared working-copy edits.
• Document the child-pane workflow and add unit and Herdr end-to-end coverage for lifecycle, launch, ownership, and cleanup behavior.

Risk Assessment

✅ Low: The bounded child-pane lifecycle is well-contained, preserves the required fail-closed teardown behavior, and includes behavior-oriented coverage for the introduced launch, ownership, delivery, and cleanup paths.

Testing

Diff checks, focused child/Herdr lifecycle tests, the real Herdr/Pi same-tab end-to-end flow, and teardown safety tests all passed; the evidence transcript demonstrates concurrent bounded panes, guarded operations, private completion, and exact cleanup. No screenshot was captured because the real terminal panes are intentionally destroyed by the lifecycle test, so the preserved end-user CLI transcript is the reviewer-visible artifact.

Evidence: Real Herdr child-pane lifecycle transcript

Two real Pi children ran concurrently in distinct panes within the parent Herdr tab, completed bounded edits, exercised safety refusals, and cleaned up without affecting the parent or control tab.

ok - isolated lab has one parent task tab and one non-target control tab
created child alpha pane=w1:p3 paths=a.txt report=/tmp/fm-child-herdr-e2e-64343/children/alpha/report.md
created child beta pane=w1:p4 paths=b.txt report=/tmp/fm-child-herdr-e2e-64343/children/beta/report.md
ok - two distinct child agent panes are concurrently present in the exact parent tab and shared worktree
ok - both real Pi children completed independently and reported only through private records
ok - disjoint edits and Git, validation, publication, and recursive-delegation refusals are preserved in private reports
ok - exact cleanup removes only child panes and records while preserving parent, control tab, and shared edits

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Inspected git diff --stat, git diff --name-only, and git diff --check for a2ba0efc7805e2b17b48d984c0e6d3713ac93fe0..6ce09d0f183c988c5623995fd4187d25508c64fc.
• bin/fm-test-run.sh tests/fm-child.test.sh tests/fm-backend-herdr.test.sh --json /var/folders/pb/bf5sf79j61bc37mnkt9kwt3h0000gn/T/no-mistakes-evidence/01KZN55M11B7G74VGTYM704RB2/focused-tests.json
• FM_CHILD_HERDR_E2E=1 FM_CHILD_E2E_POLLS=240 tests/fm-child-herdr-e2e.test.sh 2>&1 | tee /var/folders/pb/bf5sf79j61bc37mnkt9kwt3h0000gn/T/no-mistakes-evidence/01KZN55M11B7G74VGTYM704RB2/child-herdr-e2e.log
• bin/fm-test-run.sh tests/fm-teardown.test.sh --json /var/folders/pb/bf5sf79j61bc37mnkt9kwt3h0000gn/T/no-mistakes-evidence/01KZN55M11B7G74VGTYM704RB2/teardown-test.json
• Verified git status --short remained empty and checked for transient test artifacts in the worktree.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.