Subagent reports get an anti-injection wrapper, switched off in this build

When a subagent finishes, its report is re-emitted indented under a preamble telling the model the text is model output carrying no user authority, so instructions embedded in it cannot pass as commands. The section list is hashed so the notes and tail split cannot be forged, and a failed split is reported as degraded. Off unless enabled: CLAUDE_CODE_HANDBACK_PROVENANCE is checked first, otherwise the tengu_melodic_wolf setting, which falls back to off.