fix(delegate-task): Wave 1 - fix polling timeout, resource cleanup, tool restrictions, idle dedup, auth-plugins JSONC, CLI runner hang

- fix(delegate-task): return error on poll timeout instead of silent null
- fix(delegate-task): ensure toast and session cleanup on all error paths with try/finally
- fix(delegate-task): apply agent tool restrictions in sync-prompt-sender
- fix(plugin): add symmetric idle dedup to prevent double hook triggers
- fix(cli): replace regex-based JSONC editing with jsonc-parser in auth-plugins
- fix(cli): abort event stream after completion and restore no-timeout default

All changes verified with tests and typecheck.

src/tools/delegate-task/sync-session-poller.ts

@@ -36,6 +36,7 @@ export async function pollSyncSession(
   const syncTiming = getTimingConfig()
   const pollStart = Date.now()
   let pollCount = 0
+  let timedOut = false
 
   log("[task] Starting poll loop", { sessionID: input.sessionID, agentToUse: input.agentToUse })
 
@@ -93,8 +94,9 @@ export async function pollSyncSession(
   }
 
   if (Date.now() - pollStart >= syncTiming.MAX_POLL_TIME_MS) {
+    timedOut = true
     log("[task] Poll timeout reached", { sessionID: input.sessionID, pollCount })
   }
 
-  return null
+  return timedOut ? `Poll timeout reached after ${syncTiming.MAX_POLL_TIME_MS}ms for session ${input.sessionID}` : null
 }