fix(delegate-task): Wave 1 - fix polling timeout, resource cleanup, tool restrictions, idle dedup, auth-plugins JSONC, CLI runner hang

- fix(delegate-task): return error on poll timeout instead of silent null
- fix(delegate-task): ensure toast and session cleanup on all error paths with try/finally
- fix(delegate-task): apply agent tool restrictions in sync-prompt-sender
- fix(plugin): add symmetric idle dedup to prevent double hook triggers
- fix(cli): replace regex-based JSONC editing with jsonc-parser in auth-plugins
- fix(cli): abort event stream after completion and restore no-timeout default

All changes verified with tests and typecheck.

src/plugin/event.ts

@@ -52,11 +52,13 @@ export function createEventHandler(args: {
   }
 
   const recentSyntheticIdles = new Map<string, number>()
+  const recentRealIdles = new Map<string, number>()
   const DEDUP_WINDOW_MS = 500
 
   return async (input): Promise<void> => {
     pruneRecentSyntheticIdles({
       recentSyntheticIdles,
+      recentRealIdles,
       now: Date.now(),
       dedupWindowMs: DEDUP_WINDOW_MS,
     })
@@ -69,6 +71,7 @@ export function createEventHandler(args: {
           recentSyntheticIdles.delete(sessionID)
           return
         }
+        recentRealIdles.set(sessionID, Date.now())
       }
     }
 
@@ -77,6 +80,11 @@ export function createEventHandler(args: {
     const syntheticIdle = normalizeSessionStatusToIdle(input)
     if (syntheticIdle) {
       const sessionID = (syntheticIdle.event.properties as Record<string, unknown>)?.sessionID as string
+      const emittedAt = recentRealIdles.get(sessionID)
+      if (emittedAt && Date.now() - emittedAt < DEDUP_WINDOW_MS) {
+        recentRealIdles.delete(sessionID)
+        return
+      }
       recentSyntheticIdles.set(sessionID, Date.now())
       await dispatchToHooks(syntheticIdle)
     }