fix(#173): pass agent info to TaskTool.init() for permission enforcement

[randomm]

Summary

Fixes #173 — granular task permissions (permission.task with per-agent allow/deny) were never enforced because TaskTool.init() was called without the agent parameter.

Changes

• prompt.ts: Pass await Agent.get(task.agent) to TaskTool.init({ agent: agentInfo }) so permission filtering activates
• manifest.json: Added Agent.get(task.agent) as criticalCode marker in async-tasks feature
• Test hardening: Defensive env var restore in agent, skill, and tool tests (from [BUG] Fix broken test suite — null byte in config path + missing gitlab export #171 work)

Verification

• ✅ Task tests: 5/5 pass
• ✅ Permission tests: 21/21 pass
• ✅ Typecheck: 11/11 pass
• ✅ Fork-features verify: 40/40 pass

[randomm]

✅ CODE REVIEW: APPROVED

⚠️ Cannot submit formal GitHub approval (same-author restriction). This is the code-review-specialist's verdict: APPROVE.

CI/CD: ✅ All checks passing (test: 1m16s)

Core Fix Review

The one-line fix in prompt.ts is correct and minimal:

const agentInfo = await Agent.get(task.agent)
const taskTool = await TaskTool.init({ agent: agentInfo })

Verification:

• Agent is already imported at line 10 — no new imports needed
• Agent.get() returns Agent.Info | undefined; InitContext.agent is typed as Agent.Info | undefined (optional) — types align perfectly
• If Agent.get() returns undefined (impossible in practice since TaskTool.execute validates the agent at line 162), the code degrades gracefully to the existing no-filtering behavior
• The registry's ToolRegistry.forPrompt() already passes { agent } at line 158 for all other tools — this fix brings TaskTool.init() in the subtask path into consistency with the standard tool init pattern
• Single call site for TaskTool.init() in the codebase — no other locations need updating

Secondary Changes

Test hardening (env var restore): Correct defensive pattern — delete when original was undefined instead of assigning undefined string. Prevents env pollution between test runs.

Preload mock fix: mockPlugin changed to async () => ({}) and gitlabAuthPlugin export added — forward-compatibility improvements, low risk.

Fork manifest: Agent.get(task.agent) added as criticalCode marker in async-tasks feature — correctly tracks fork divergence.

Risk: LOW

• 2 lines of production code changed
• Mechanically straightforward plumbing fix
• No new dependencies, no control flow changes
• Graceful degradation on edge cases