fix(delegate-task): Wave 1 - fix polling timeout, resource cleanup, tool restrictions, idle dedup, auth-plugins JSONC, CLI runner hang

- fix(delegate-task): return error on poll timeout instead of silent null
- fix(delegate-task): ensure toast and session cleanup on all error paths with try/finally
- fix(delegate-task): apply agent tool restrictions in sync-prompt-sender
- fix(plugin): add symmetric idle dedup to prevent double hook triggers
- fix(cli): replace regex-based JSONC editing with jsonc-parser in auth-plugins
- fix(cli): abort event stream after completion and restore no-timeout default

All changes verified with tests and typecheck.

src/tools/delegate-task/sync-task.ts

@@ -102,30 +102,25 @@ export async function executeSyncTask(
       return promptError
     }
 
-    const pollError = await pollSyncSession(ctx, client, {
-      sessionID,
-      agentToUse,
-      toastManager,
-      taskId,
-    })
-    if (pollError) {
-      return pollError
-    }
+    try {
+      const pollError = await pollSyncSession(ctx, client, {
+        sessionID,
+        agentToUse,
+        toastManager,
+        taskId,
+      })
+      if (pollError) {
+        return pollError
+      }
 
-    const result = await fetchSyncResult(client, sessionID)
-    if (!result.ok) {
-      return result.error
-    }
+      const result = await fetchSyncResult(client, sessionID)
+      if (!result.ok) {
+        return result.error
+      }
 
-    const duration = formatDuration(startTime)
+      const duration = formatDuration(startTime)
 
-    if (toastManager) {
-      toastManager.removeTask(taskId)
-    }
-
-    subagentSessions.delete(sessionID)
-
-    return `Task completed in ${duration}.
+      return `Task completed in ${duration}.
 
 Agent: ${agentToUse}${args.category ? ` (category: ${args.category})` : ""}
 
@@ -136,13 +131,15 @@ ${result.textContent || "(No text output)"}
 <task_metadata>
 session_id: ${sessionID}
 </task_metadata>`
+    } finally {
+      if (toastManager && taskId !== undefined) {
+        toastManager.removeTask(taskId)
+      }
+      if (syncSessionID) {
+        subagentSessions.delete(syncSessionID)
+      }
+    }
   } catch (error) {
-    if (toastManager && taskId !== undefined) {
-      toastManager.removeTask(taskId)
-    }
-    if (syncSessionID) {
-      subagentSessions.delete(syncSessionID)
-    }
     return formatDetailedError(error, {
       operation: "Execute task",
       args,