feat(interface): add child-task stream event and environment creation verdict

[drewstone]

Why

• feat(events): expose stable provider-native child task lifecycle agent-runtime#756: the canonical StreamEvent union has no child-task lifecycle event, so provider-native subagents (Claude Code, OpenCode, Codex) cannot reach clients without runner-specific parsing.
• bug(retained): destroy the environment when detached dispatch fails agent-runtime#799: AgentEnvironmentProvider.create gives the caller no way to prove whether the call provisioned the environment or replayed an existing one, so a failed follow-up cannot decide whether destroy is safe.

What

• child-task stream event (packages/agent-interface/src/stream-events.ts): stable childId, optional parentChildId, status (started|running|completed|failed|cancelled), title, time{started,updated,ended?}, runner, model, usage (shared TokenUsage), terminalReason, sourceEventId for replay dedupe, and a bounded opaque raw. Identity never depends on raw; a provider without a stable childId emits no event. The docs comment carries a dedupe-by-sourceEventId example.
• Matching z.strictObject member in CanonicalStreamEventSchema (src/runtime-control.ts) with certainty refinements: time.ended/terminalReason only with a terminal status, update/end times never precede start, no self-parent.
• AgentEnvironment.creation?: "created" | "replayed" + AgentEnvironmentCreationSchema (src/environment-runtime.ts). createAgentEnvironmentWithIdempotency now returns a replayedAgentEnvironmentView (shared members, creation: "replayed") for every same-key call after the first, including callers that awaited the same pending create. Absent means unknown; consumers fail closed and never destroy what they cannot prove they created.
• Tangle provider maps the Sandbox platform create receipt (created → created, idempotent_replay → replayed, unknown/absent → absent) via a new optional SandboxInstanceLike.createReceipt?().
• CLI Bridge provider states created on the call that builds the environment handle; a get() reconstruction states nothing. (The bridge POST /v1/sessions happens at dispatch, not create, so create-time truth is the handle provisioning.)
• Testkit provider conformance rejects a same-key replay that claims created.

Proof

• pnpm build: all 10 packages Done.
• pnpm check-types: 0 errors.
• pnpm test: 1519 passed, 0 failed — interface 455 (+4), testkit 26 (+2), cli-bridge 199, tangle 146 (+1), core 505, trace-contract 182, e2b/daytona/computesdk 2 each.
• pnpm check:package-artifacts: 9 isolated packages, 31 exports, 62 export targets.
• pnpm check:control-artifacts: packed cohort 7 test files, 141 tests passed (+4).
• New tests: runtime-control.test.ts child-task accept/reject matrix (15 reject cases), RuntimeEventEnvelope round-trip, live-vs-replay dedupe tree equality; environment-provider.test.ts replayed-view semantics, pending-coalesce view, class-instance refusal, creation schema; tangle receipt mapping (5 variants); cli-bridge created/absent-on-get; testkit per-call verdict + replay-claims-created rejection.

Changesets: @tangle-network/agent-interface minor (1.4.0); @tangle-network/agent-provider-tangle, @tangle-network/agent-provider-cli-bridge, @tangle-network/agent-provider-testkit patch.

Refs tangle-network/agent-runtime#756
Refs tangle-network/agent-runtime#799

[tangletools]

✅ Auto-approved drewstone PR — 3cc0ece1

This PR was opened by the trusted drewstone account.

This approval is provisional and was applied by the local stand-in because the pr-reviewer webhook host is unreachable (2026-08-21). CI on this head is fully green. The full PR reviewer audit re-runs via the resweep when the service returns and will publish findings if it detects issues.