fix: sync council-member tool restrictions across all layers, optimize athena guards

- Add switch_agent/background_wait to agent-tool-restrictions.ts (boolean format)
- Add dynamic council member name matching via COUNCIL_MEMBER_KEY_PREFIX
- Move athena question permission from hardcoded to tool-config-handler (CLI-mode aware)
- Rename appendMissingCouncilPrompt -> applyMissingCouncilGuard
- Optimize tool-execute-before: check hasPendingCouncilMembers before resolving session agent
- Add fallback_models to council-member/athena in schema.json
- Remove unused createAthenaAgent export from agents/index.ts
- Add cross-reference comments for restriction sync points

src/plugin-handlers/tool-config-handler.ts

@@ -122,6 +122,10 @@ export function applyToolConfig(params: {
       ...denyTodoTools,
     };
   }
+  // NOTE: Athena/council tool restrictions are also defined in:
+  // - src/agents/athena/agent.ts (AgentConfig permission format)
+  // - src/shared/agent-tool-restrictions.ts (boolean format for session.prompt)
+  // Keep all three in sync when modifying.
   const athena = agentByKey(params.agentResult, "athena");
   if (athena) {
     athena.permission = {