feat(subagents): support explicit capability inheritance

[aatosolavi]

Summary

Allow declared subagents to opt into selected parent capabilities while keeping isolation by default:

• inherit.sandbox: true shares the parent's live sandbox session (not a seed copy)
• inherit.connections: true reuses the parent's resolved connection definitions (normal auth resolution; no credential copying)
• Child keeps its own instructions, tools, skills, hooks, and durable state
• Compiler rejects invalid combinations (root inherit, own sandbox + inherit.sandbox)
• eve info / agent-info surface effective owned vs inherited capabilities
• Extension capability epochs bumped for transitive public-type changes

This rebases and completes the approach from #639 onto current main so CI can run on an up-to-date branch.

Closes #626.
Related: #639 (original implementation by @iroiro147).

Example

export default defineAgent({
  description: "Review this change for security risks.",
  inherit: {
    sandbox: true,
    connections: true,
  },
});

Tests

• pnpm --filter eve typecheck
• Inheritance-related unit suite (vitest.unit.config.ts): 177 passed
• pnpm docs:check
• pnpm guard:invariants
• pnpm fmt / pnpm lint

Notes for reviewers

• Default isolation is unchanged; inheritance is explicit and per capability.
• Shared sandbox concurrent-write guidance matches the built-in agent contract.
• Nested inheritance resolves from the immediate parent.

[vercel]

@aatosolavi is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

[aatosolavi]

CI status note

GitHub Actions for this PR are currently action_required (first-time external contributor workflow approval):

• CI
• E2E Tests (Local)
• E2E Tests (Vercel)
• Bundle Analysis

A maintainer needs to click Approve and run on those workflows so the full suite can execute. Local verification already passed:

• pnpm --filter eve typecheck
• Inheritance unit suite: 177 passed
• pnpm docs:check
• pnpm guard:invariants
• DCO + signed commit ✅

[aatosolavi]

CONTRIBUTING.md compliance audit

Requirement	Status
Fork + branch from main	✅
Issue linked (#626)	✅
Tests + docs for public behavior	✅
Changeset for eve package	✅
Signed-off-by DCO on every commit	✅ (DCO check green)
Cryptographically signed commit	⚠️ signed locally with SSH; GitHub shows Unverified (unknown_key) until the SSH key is added as a signing key on the author account
Single reviewable purpose	✅ (no merge commits)
Extension capability epochs bumped + retained fixtures	✅
pnpm lint	✅
pnpm typecheck (Node 24)	✅
pnpm test unit	✅ 5490 passed
pnpm test integration	✅ 550 passed
pnpm docs:check	✅
pnpm guard:invariants	✅

Action needed for Verified commits (CONTRIBUTING “Signed commits”):

1. Add this public key as an SSH signing key at https://github.com/settings/keys
   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMWGUHmippQ6GYJu6gyljhSlxcSY22uvthEvcFUYsEB+
2. Confirm the commit badge on the PR becomes Verified.

GitHub Actions still need a maintainer Approve and run for first-time external contributors.