emrg: a scheduled task has no owner role — it decides the direction and does the work in the same round #2467

What was observed

Each of the eight scheduled task templates in emrg/server/scheduler.py (TASK_TEMPLATES, from
evolution / paper / open-source / promote / journal / competition / ios-app /
feishu) is a single agent that both decides the direction of the round and then does the work
in that round.

There is no separate role that holds the whole picture and states the stance. Two routes exist
today and both were measured:

1. Bake review semantics into the built-in subagent tool's schema. Rejected: subagent is
   a general tool, and giving it a fixed review meaning narrows what every other caller gets.
2. Write "first call subagent with a brief like this" into the template prose. Measured
   execution rate across rounds: 16% → 56% → 31% — writing more detail made it worse, not
   better. And the brief is written by the parent agent, so it loses the position: it can reduce
   to review the previous rounds.

What is expected

A new tool named boss, whose caller is the worker and whose child session is the owner of
this task.

1. Three parameters only: focus (optional — the specific point the parent wants looked at),
   timeout_s (default the same 600 as subagent), intent (required, as on every other tool).
   The parent calls it, receives an answer, and treats that answer as this round's stance
   constraint.

2. It reads the task itself, not a retelling. The child session's cwd is
   <parent session dir>/sub-agent/sub-boss, so the parent's directory is reachable from its own
   cwd and the child can read the parent's history.jsonl directly: the last user record is the
   whole task statement (measured on one schedule: 43,083 characters including extra_prompt),
   followed by the most recent rounds' tool calls and results. The parent supplies no part of
   the task statement.

3. The child session persists across rounds — it is not cleared per round. The existing
   subagent slot mechanism clears a slot on selection (sub-agent/sub{slot} in
   emrg/server/daemon.py), which is wrong here: clearing per round pays to re-read the whole
   statement every round and throws away what it saw last round. Give it a fixed directory
   sub-boss that is independent of the nine LRU slots: created on the parent's first call,
   reused afterwards, removed together with sub-agent/ when the parent session is deleted. The
   depth limit stays SUBAGENT_MAX_DEPTH.

4. Its prompt is its own template, not a string in code. Add
   emrg/server/prompts/boss.j2, rendered through the existing _get_jinja_env() so the host can
   reword it without a restart (the same convention memory_compaction.j2 follows). The template
   tells the child only: that it owns this task and the parent session is the worker, where the
   task statement is, that it should read the most recent rounds, and that it should state the
   stance and the bottom line rather than list problems. The point of the output is a position:
   how this stage should be done, what is unacceptable, and where the next step goes.

5. One sentence on the parent side. Each of the eight template files in that directory (the
   evolution template and the seven beside it) gains the same sentence: the first step of every
   round is to call boss and treat its answer as the round's stance constraint, while anything
   it did not mention remains the parent's own judgement. Nothing else in those templates changes.
   Do not append that sentence from code — the templates are host-editable text, and an
   obligation hidden in code is invisible to the host.

6. Reaching only scheduled tasks. Once emrg: a message cannot choose which tools the session gets — the table is fixed at daemon start #2465 lands (a message names the tools its turn may
   use, and a session gets the intersection), boss is written into the scheduled-task whitelist
   only, and a host session never sees it. If this lands separately and first, the implementer
   must build the equivalent gate itself — boss must not appear in a host session's tool table.
   The cheapest equivalent reuses the "input_history": False field the scheduler already sends
   (scheduler.py:2697): it already distinguishes "this message was not typed by the host", so
   recording it on the session answers the same question.

Cost (this must be stated in the PR description)

Keeping sub-boss across rounds means the task statement is read once: 43,083 characters is about
20k tokens, roughly ¥0.034 at an uncached price; each later round is a cache hit on its own
context plus the parent's few new rounds, roughly ¥0.001–0.003. At 40 cycles a day that is under
¥0.1 per cycle added. Clearing the child every round re-pays for the same statement every round,
which moves that by an order of magnitude — this is the reason item 3 exists.

Acceptance

• One real call. A test builds a parent session (history.jsonl holding a task statement plus
  two rounds), calls boss, and asserts the child actually read that statement — for example a
  string that appears only in the statement reaches the child's request.
• Persistence. Two consecutive calls: the second does not rebuild the child directory. After
  the parent session is deleted, sub-boss disappears with it.
• The gate. With emrg: a message cannot choose which tools the session gets — the table is fixed at daemon start #2465 unmerged, a host session cannot reach boss (or its call is refused);
  once emrg: a message cannot choose which tools the session gets — the table is fixed at daemon start #2465 is merged the tool-table filter carries it, and the test asserts boss is absent from
  the default set instead.
• A template guard. All eight templates carry the sentence; deleting it from any one template
  turns its test red.
• boss.j2 is editable. Changing the template text takes effect on the next call, with no
  daemon restart.

Out of scope

Not changing the shape or meaning of the built-in subagent; no separate model or temperature for
boss; no "multiple owners" and no voting among them.