Keep native subagent composers visible and disabled - #446

Native Codex and Claude Code subagent threads previously replaced the entire composer with a read-only caption, hiding their model and execution settings. Keep the composer visible and disabled, move the existing localized caption into the text field, and retain the model, reasoning effort, access mode and Build/Plan controls. Narrow layouts show access and mode in the drawer. Returning to a normal thread restores its editable draft.

The runtime mirror owner now inherits parent settings at creation and persists provider-reported child model and effort. Later events with missing fields preserve the last observation. The UI derives read-only state from the existing session index; no new protocol field, dependency or provider-specific UI path is introduced. Updated the visual contract in docs/DESIGN.md.

Tests extend the runtime mirror contract to cover inherited settings, child overrides and persistence across completion. The shell test exercises inert controls at 1200, 760 and 393 logical pixels, an effort value for an uncatalogued model, and restoring the parent draft. No coverage was removed.

Validation performed locally on macOS:

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo build --workspace --locked
• cargo test --workspace --locked (1150 passed, 0 failed, 5 explicitly ignored), followed by UI tests after final UI guard refinements
• cargo-machete . (0.9.2; the installed binary's cargo machete invocation treats the subcommand name as a path)
• iOS simulator, Android and Web checks from CI with RUSTFLAGS='-D warnings'
• Launched an isolated disposable profile containing Codex and Claude native-mirror fixtures; checked light/dark and wide/393px layouts, disabled input and visible model/effort/mode controls. Screenshots captured locally.

No live provider task was submitted for visual verification. Native Windows/Linux validation is delegated to CI. Desktop builds retain existing linker unwind-table and block future-compatibility warnings.

CI follow-up: the initial macOS run failed the existing session_replica_matches_live_timeline_for_synthetic_turn test (the live timeline lacked the initial replayed turn). Both tests changed by this PR passed. The existing test passed 100 consecutive local repetitions; rerunning the macOS job on the identical commit passed. All six CI checks are now green. The underlying intermittent failure was not reproduced locally or changed in this PR.