fix(runtime): fleet-wide subagent ban — no role fans out, not one (#372)

CEO directive 2026-07-09: every allows_subagent in role_config flips to
False (was True for cell_pm, main_pm, product_owner, head_marketing,
prompter, secretary); the grok path's drifted _SUBAGENT_ALLOWED_ROLES
allowlist empties to match. The spawn manifest already consumes the
flag, so Claude-path agents lose the Agent tool and grok-path agents
get it in disallowed-tools by construction. New invariant test iterates
every role config so a single role can't quietly regain it.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/gateway/test_role_config.py

@@ -46,7 +46,14 @@ class TestRoleConfigCatalog:
         assert "complete" in cfg.flow_tools
         assert "unblock" in cfg.flow_tools
         assert "triage" in cfg.flow_tools
-        assert cfg.allows_subagent is True  # PMs may need parallel research
+        assert cfg.allows_subagent is False  # fleet-wide subagent ban (2026-07-09)
+
+    def test_no_role_allows_subagents(self) -> None:
+        # Fleet-wide invariant (CEO, 2026-07-09): not a single role fans out.
+        from roboco.services.gateway.role_config import ROLE_CONFIGS
+
+        for role, cfg in ROLE_CONFIGS.items():
+            assert cfg.allows_subagent is False, role
 
     def test_main_pm_config(self) -> None:
         cfg = get_role_config("main_pm")