feat(agent): enable delegated command execution

[fcoury-oai]

Delegate threads introduced by #346 run in isolated worktrees, but isolation alone is not enough for longer autonomous tasks: they need to run builds and tests, expose useful progress, and remain interruptible without changing Pair behavior.

This change gives Delegate sessions a native Codex workspace-write sandbox scoped to the delegated worktree. Network access and temporary-directory writes remain disabled, while Pair sessions keep their existing read-only policy.

The Threads workspace now shows the current delegated command in the running row and its full status in the detail pane. Running delegates can be stopped with x; the conversation remains available with a Stopped status and cannot be incorrectly promoted to Ready to review by the later interruption event.

Depends on #346.

How to Test

1. Create a delegated thread from the Agent pane and ask it to run a project command such as cargo test. Confirm the command runs inside the delegated worktree while the current Pair thread stays selected.
2. Open Threads while the command is running. Confirm the row shows a compact activity label and the detail pane shows the full command and working directory. After completion, confirm the exit code and duration appear and the thread moves to Ready to review.
3. Start a longer delegated command and press x on its running thread. Confirm Red reports that it is stopping, preserves the conversation, and shows Stopped rather than Ready to review after interruption completes.
4. Press x on a Pair thread or a delegate that is not running. Confirm no session is cancelled and Red explains that only running delegated work can be stopped.
5. Resume a delegated conversation and confirm subsequent commands remain scoped to its worktree. Start a Pair conversation and confirm it retains the existing read-only editor-tool workflow.

Targeted automated coverage includes delegated_app_server_uses_workspace_write_and_reports_command_activity, bundled_agent_threads_show_and_stop_running_delegate_activity, stopped_delegate_does_not_become_ready_when_interruption_finishes, and command_execution_reports_bounded_progress_without_output.