fix: remove MADZ_SUBAGENT_TIMEOUT and MADZ_SESSION_ID dead code from subAgent

[avoidwork]

Description

Remove two pieces of dead code from the subAgent tool: the MADZ_SUBAGENT_TIMEOUT environment variable check (which creates a third configuration path bypassing the centralized config system) and the MADZ_SESSION_ID environment variable (which is passed to child processes but never consumed).

Type of Change

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor (no functional changes)
• Performance improvement
• CI / build / tooling

Testing

• OpenSpec artifacts generated and validated (proposal.md, design.md, specs/subagent/spec.md, tasks.md)
• Delta spec created for subagent capability with MODIFIED requirements for timeout enforcement, child process environment, and configuration
• All existing tests will be updated to remove env var priority assertions
• Test suite run via npm run test to verify no regressions

Coverage

• 100% line coverage maintained

Checklist

• npm run lint passes
• Tests pass with 100% line coverage
• No forbidden patterns used
• Conventional Commit style applied

Related Issue

Closes #441

[avoidwork]

Audit Results: Remove subAgent Dead Code

Implementation Audit

Goal Fulfillment

• Goal 1 (Remove MADZ_SUBAGENT_TIMEOUT): ✅ Complete

  • Removed process.env.MADZ_SUBAGENT_TIMEOUT check from resolveTimeout() in src/tools/subAgent.js
  • Fallback chain now correctly: per-call → config.yaml → hardcoded default (600000ms)
  • Tool description updated to remove "Overrides MADZ_SUBAGENT_TIMEOUT env var" reference
  • JSDoc comment updated to reflect new priority chain

• Goal 2 (Remove MADZ_SESSION_ID): ✅ Complete

  • Removed MADZ_SESSION_ID from child process environment in src/tools/subAgent.js
  • Simplified env from {...process.env, MADZ_SESSION_ID: sessionId} to process.env
  • Updated openspec/specs/subagent-session-id/spec.md to remove "Session ID Propagation" requirement

• Goal 3 (Update tests): ✅ Complete

  • Removed "should use env var when per-call is not provided" test
  • Removed "should use env var over config default" test
  • Removed "should pass session ID to child process via MADZ_SESSION_ID env var" test

Spec Compliance

• Delta spec for subagent capability correctly captures:
  • Modified "Timeout enforcement" requirement (removed env var from priority chain)
  • New "Child process environment" requirement (no dead env vars)
  • Modified "Configuration" requirement (removed env var from config defaults scenario)
• Delta spec for subagent-session-id capability correctly removes "Session ID Propagation" requirement

Task Completion

All 12 tasks in tasks.md completed:

• Tasks 1.1-1.3: MADZ_SUBAGENT_TIMEOUT removal ✅
• Tasks 2.1-2.3: MADZ_SESSION_ID removal ✅
• Tasks 3.1-3.3: Test updates ✅
• Tasks 4.1-4.3: Verification ✅

Quality Check

• Tests: 1176 pass, 0 fail, 1 skipped (abort signal test - pre-existing skip)
• Lint: 0 warnings, 0 errors
• Coverage: Maintained (pre-commit hook enforces 100%)
• No forbidden patterns: No console.log, no empty catch blocks, no hardcoded secrets
• Application start: Expected TUI error in non-interactive mode (not a crash)

Changes Summary

• src/tools/subAgent.js: Removed MADZ_SUBAGENT_TIMEOUT env var check, removed MADZ_SESSION_ID from child env, updated tool description and JSDoc
• tests/unit/tools/subAgent.test.js: Removed 3 tests validating dead env var behavior
• openspec/specs/subagent-session-id/spec.md: Removed "Session ID Propagation" requirement

Result

✅ All goals fulfilled, all specs compliant, all tasks complete, all verifications passed. No errors remaining.