fix(delegate-task): Wave 1 - fix polling timeout, resource cleanup, tool restrictions, idle dedup, auth-plugins JSONC, CLI runner hang

- fix(delegate-task): return error on poll timeout instead of silent null
- fix(delegate-task): ensure toast and session cleanup on all error paths with try/finally
- fix(delegate-task): apply agent tool restrictions in sync-prompt-sender
- fix(plugin): add symmetric idle dedup to prevent double hook triggers
- fix(cli): replace regex-based JSONC editing with jsonc-parser in auth-plugins
- fix(cli): abort event stream after completion and restore no-timeout default

All changes verified with tests and typecheck.

src/tools/delegate-task/sync-prompt-sender.ts

@@ -2,6 +2,7 @@ import type { DelegateTaskArgs, OpencodeClient } from "./types"
 import { isPlanFamily } from "./constants"
 import { promptWithModelSuggestionRetry } from "../../shared/model-suggestion-retry"
 import { formatDetailedError } from "./error-formatting"
+import { getAgentToolRestrictions } from "../../shared/agent-tool-restrictions"
 
 export async function sendSyncPrompt(
   client: OpencodeClient,
@@ -26,6 +27,7 @@ export async function sendSyncPrompt(
           task: allowTask,
           call_omo_agent: true,
           question: false,
+          ...getAgentToolRestrictions(input.agentToUse),
         },
         parts: [{ type: "text", text: input.args.prompt }],
         ...(input.categoryModel ? { model: { providerID: input.categoryModel.providerID, modelID: input.categoryModel.modelID } } : {}),