fix(delegate-task): Wave 1 - fix polling timeout, resource cleanup, tool restrictions, idle dedup, auth-plugins JSONC, CLI runner hang

- fix(delegate-task): return error on poll timeout instead of silent null
- fix(delegate-task): ensure toast and session cleanup on all error paths with try/finally
- fix(delegate-task): apply agent tool restrictions in sync-prompt-sender
- fix(plugin): add symmetric idle dedup to prevent double hook triggers
- fix(cli): replace regex-based JSONC editing with jsonc-parser in auth-plugins
- fix(cli): abort event stream after completion and restore no-timeout default

All changes verified with tests and typecheck.

src/plugin/recent-synthetic-idles.ts

@@ -1,13 +1,20 @@
 export function pruneRecentSyntheticIdles(args: {
   recentSyntheticIdles: Map<string, number>
+  recentRealIdles: Map<string, number>
   now: number
   dedupWindowMs: number
 }): void {
-  const { recentSyntheticIdles, now, dedupWindowMs } = args
+  const { recentSyntheticIdles, recentRealIdles, now, dedupWindowMs } = args
 
   for (const [sessionID, emittedAt] of recentSyntheticIdles) {
     if (now - emittedAt >= dedupWindowMs) {
       recentSyntheticIdles.delete(sessionID)
     }
   }
+
+  for (const [sessionID, emittedAt] of recentRealIdles) {
+    if (now - emittedAt >= dedupWindowMs) {
+      recentRealIdles.delete(sessionID)
+    }
+  }
 }