feat(runtime): bound active child executions per session

[outlier27-cell]

Problem

Relates to #159. A top-level Pi Session can currently combine each Workflow run's local concurrency with Direct Subagent and BTW pools, without one truthful limit on simultaneously active child model-session executions. This first implementation phase deliberately excludes Background Terminal and non-model resource accounting.

Value

An operator can explicitly bound active Workflow, Direct Subagent, and BTW child executions for one top-level Pi Session without weakening each entry point's existing lifecycle, permissions, local limits, or result delivery. The default remains unchanged when unconfigured.

Approach

• Add a SessionManager-owned, FIFO, bounded and abortable admission lease for active child execution attempts.
• Acquire the existing local allowance before the shared lease, and acquire the shared lease before child construction/restart. Workflow local concurrency/call limits, Direct pool 4, and BTW pool 2 remain independent guards.
• Release only on terminal evidence. Queued cancellation and shutdown reject waiters; an uncertain stop retains its lease fail-closed. Leases are idempotent and attempt-scoped, and dormant children reacquire before a later send.
• Add opt-in childExecutions.maxActive (1-64) through /openpi-setup, status, documentation, validation, TUI, and the Web capability projection. The default is disabled; enabling during active work accounts for existing attempts and rejects a lower-than-held limit.
• Record the bounded runtime: 建立跨 Subagent、Workflow 与 Background Terminal 的总资源准入合同 #159 scope in the design archive. No provider, token, cost, 429, terminal, worktree, artifact, or global-scheduler behavior is claimed.

Validation

• bun.cmd test tests/extensions/shared/child-execution-admission.test.ts tests/extensions/subagents/manager.test.ts tests/extensions/workflows/controller.test.ts — 36 passed.
• bun.cmd test tests/extensions/setup/index.test.ts tests/extensions/suggestions/config.test.ts — 46 passed.
• bun.cmd x vitest run tests/web/subagent-panel.spec.ts — 17 passed.
• bun.cmd run check — passed (config/docs contracts, discipline ledger, Web build, format, lint, and typecheck).
• git diff --check — passed.
• bun.cmd run test was started but did not complete locally: it reached pre-existing real-Pi tests/extensions/post-edit/lifecycle.test.ts timeouts/failures and then stopped making progress. Those files are outside this diff; this PR does not report the full suite as green.

Impact

• User-visible: Opt-in /openpi-setup setting and aggregate TUI/Web slot status; no queued task text is exposed.
• Model-visible: No new resident model tool, model choice, thinking-level behavior, or child permission change.
• Runtime/lifecycle: Workflow, Direct, and BTW share a top-level Session-only active-execution ceiling while retaining their local ceilings; uncertain termination fails closed.
• Persisted config: Adds optional childExecutions.maxActive; omitted/invalid/old configurations retain unbounded historical behavior.
• Compatibility/risk: Disabled by default. This is phase one only and intentionally does not regulate Background Terminal, providers, cost, tokens, 429s, memory, worktrees, or artifacts.