Fix subagent project scope corrections

[Aaronontheweb]

Summary

• return the existing project-scope declaration correction to subagents before opening the parent approval bridge
• apply a successful set_working_directory declaration only to the child run, reload its project instructions, and keep the parent project unchanged
• prevent headless correction loops without granting headless execution authority
• reject NUL, CR, and LF at the shared working-directory declaration boundary

Why

A subagent could issue reviewed-safe work beneath an undeclared project cwd, receive a user approval prompt, and never get the same model-facing correction available to a parent session. Merely returning the correction was insufficient: the child did not apply the declaration to later tool contexts or reload project guidance.

This keeps the original shell call and history intact. It teaches the child to declare the project through the existing tool and filesystem policy, then reevaluates the unchanged retry under the resulting child scope.

Validation

• adversarial production review: PASS, no warnings
• focused actor/policy/tool tests: 85/85
• full actor suite before final rebase: 3,181 passed, 1 expected Windows-only skip
• Release build: 0 warnings/errors
• strict OpenSpec validation
• copyright headers
• changed-file format verification
• changed-file Slopwatch: 0 findings
• PII review: no findings

The full solution run also surfaced one unrelated existing MCP diagnostic assertion mismatch in McpSdkCatalogNotificationIntegrationTests; this PR does not touch that test or MCP production code.