fix: harden workflow lifecycle, concurrency, retries, and error propagation

[liuedcson]

Summary

Fixes workflow/subagent concurrency, lifecycle, retry, and error-propagation defects found while reproducing a real "开10个子agent" session that ended in a rejected batch, ten ReferenceError callbacks, and a manual 8+2 rerun.

Workflow lifecycle

• Cancel and drain running and queued children before publishing a terminal state; terminal states are sealed and the run scope is aborted on exit.
• Failed/early-returned runs can no longer report completed with agentCalls: 0; a run that returns with unawaited agent()/iterate()/workflow() operations fails closed.
• The terminal status stays authoritative even when a progress write fails (a full disk can no longer turn a failed run into a hung one or replace the real error).

Concurrency

• Concurrent workflows share one process-wide admission window; an uncooperative runner keeps its reservation until settlement instead of permanently poisoning the window.
• Requested concurrency is clamped to a CPU-derived ceiling (max(1, min(16, cpus-2)), optionally lowered by STEP_WORKFLOW_CONCURRENCY_LIMIT, which now ignores blank/invalid values). Clamping is reported as a notice, never as a failure.
• parallel() accepts functions or promises; ordinary subagent batches larger than the concurrency window queue the excess instead of being rejected (an explicitly configured maxParallelTasks still bounds batch size).
• Explicit counted fan-out requests ("launch 10 subagents" / "开10个子agent") grant per-turn workflow consent without the Ultraloop keyword.

Error propagation

• parallel()/pipeline() callback failures are recorded as taskFailures (with script attribution for nested workflows) and surfaced in the live text rows and final result; agent-node failures are no longer double-counted as callback failures.
• AgentToolResult.isError from child tool results now propagates instead of being reported to the model as success.
• Temporary 429s get an independent retry budget with Retry-After support and adaptive admission-cap reduction/recovery; terminal quota errors (including OpenCode Zen GoUsageLimitError/FreeUsageLimitError) are never retried.
• The agent loop finalizes a partial assistant message when a provider stream throws, ends early, or fails during construction — without reclassifying listener/persistence errors as model errors or emitting a second terminal message_end.

Tests

• New: shell-interpolation regression (broken template → failed with 10 ReferenceErrors; plain string → 10 agents dispatched), nested callback attribution, no-double-counting, unawaited nested workflow, retained-reservation/pool recreation, real child-process exit drain behind a detached descendant, terminal progress-write failure, batch-size vs concurrency semantics, counted opt-in routing, 429 classification.
• Full suites: coding-agent 4469 passed (3 pre-existing completion-check-cli failures, identical on main), agent-core 536, providers 437; pnpm check clean.
• Live validation with the user's original prompt: first and only tool call is workflow, observed 8 running + 2 queued with refill before the first wave finished, 10/10 completed in ~23.5s, and each reported value matched the agent's actual command output.

[liuedcson]

Heads-up on the first CI run: build-check-test failed once on a 30s test timeout in test/suite/agent-session-tool-output.test.ts > keeps the tail and exit status of a failed command that bash already truncated (a real bash subprocess test on the shared 4-vCPU runner). All 4474 other tests passed in that run. I re-ran the failed job on the identical commit and it passed in 6m22s, so it is a runner flake, not a regression — that test file passes in ~2s locally and is untouched by this change.