fix: sync council-member tool restrictions across all layers, optimize athena guards

- Add switch_agent/background_wait to agent-tool-restrictions.ts (boolean format)
- Add dynamic council member name matching via COUNCIL_MEMBER_KEY_PREFIX
- Move athena question permission from hardcoded to tool-config-handler (CLI-mode aware)
- Rename appendMissingCouncilPrompt -> applyMissingCouncilGuard
- Optimize tool-execute-before: check hasPendingCouncilMembers before resolving session agent
- Add fallback_models to council-member/athena in schema.json
- Remove unused createAthenaAgent export from agents/index.ts
- Add cross-reference comments for restriction sync points

src/agents/builtin-agents.ts

@@ -29,7 +29,7 @@ import { maybeCreateSisyphusConfig } from "./builtin-agents/sisyphus-agent"
 import { maybeCreateHephaestusConfig } from "./builtin-agents/hephaestus-agent"
 import { maybeCreateAtlasConfig } from "./builtin-agents/atlas-agent"
 import { registerCouncilMemberAgents } from "./builtin-agents/council-member-agents"
-import { appendMissingCouncilPrompt } from "./builtin-agents/athena-council-guard"
+import { applyMissingCouncilGuard } from "./builtin-agents/athena-council-guard"
 import type { CouncilConfig } from "../config/schema/athena"
 
 type AgentSource = AgentFactory | AgentConfig
@@ -207,12 +207,12 @@ export async function createBuiltinAgents(
         prompt: (result["athena"].prompt ?? "") + councilTaskInstructions,
       }
     } else {
-      result["athena"] = appendMissingCouncilPrompt(result["athena"], skippedMembers)
+      result["athena"] = applyMissingCouncilGuard(result["athena"], skippedMembers)
     }
   } else if (councilConfig?.members && councilConfig.members.length >= 2 && !result["athena"]) {
     log("[builtin-agents] Skipping council member registration — Athena is disabled")
   } else if (result["athena"]) {
-    result["athena"] = appendMissingCouncilPrompt(result["athena"])
+    result["athena"] = applyMissingCouncilGuard(result["athena"])
   }
 
   return result