fix(runtime): fleet-wide subagent ban — no role fans out, not one (#372)

CEO directive 2026-07-09: every allows_subagent in role_config flips to
False (was True for cell_pm, main_pm, product_owner, head_marketing,
prompter, secretary); the grok path's drifted _SUBAGENT_ALLOWED_ROLES
allowlist empties to match. The spawn manifest already consumes the
flag, so Claude-path agents lose the Agent tool and grok-path agents
get it in disallowed-tools by construction. New invariant test iterates
every role config so a single role can't quietly regain it.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/runtime/test_spawn_manifest.py

@@ -36,7 +36,7 @@ class TestBuildForRole:
         assert m.bash_allowed is True
         assert "ROBOCO_SDK_URL" in m.env or "ROBOCO_PUBLIC_BASE_URL" in m.env
 
-    def test_main_pm_manifest_subagent_uses_parent_model(self) -> None:
+    def test_main_pm_manifest_denies_subagents(self) -> None:
         m = build_for_role(
             SpawnInputs(
                 agent_id=uuid4(),
@@ -46,8 +46,9 @@ class TestBuildForRole:
                 agent_model="minimax-m3:cloud",
             )
         )
-        assert m.subagent_allowed is True
-        assert m.subagent_model == "minimax-m3:cloud"
+        # Fleet-wide subagent ban (CEO, 2026-07-09) covers coordinators too.
+        assert m.subagent_allowed is False
+        assert m.subagent_model is None
 
     def test_qa_manifest_no_write(self) -> None:
         m = build_for_role(