Allow parent-child agents to always see and message each other

[selfcontained]

Summary

• Direct parent ↔ child agent relationships now always bypass repo-root scoping in addressableAgents(), so spawned agents can coordinate with their parent regardless of which git repository each is working in
• Removed the early senderRepoRoot null guards from sendMessage and listAgentsForAgent — parent/child matches don't require a resolvable repo root
• Added 8 new unit tests covering parent→child, child→parent, grandchild exclusion, and null-repoRoot + parent/child scenarios

Details

Previously, agents could only see/message other agents in the same git repository unless the global "cross-repo messaging" toggle was enabled. This meant a parent agent that launched a child into a different repo couldn't communicate with it without turning on the global setting.

Now the addressableAgents() function — the single visibility boundary for both list_agents and dispatch_send_message — checks for direct parent/child relationships before applying repo-root filtering. Only one-hop relationships qualify (grandchildren are excluded by design).

Test plan

• Unit tests: 96 tests pass in mcp-handlers.test.ts (8 new)
• Type checking: pnpm run check passes
• E2E: settings.spec.ts passes (cross-repo toggle still works)
• Live API verification: created parent/child/unrelated agents in separate git repos, confirmed visibility and messaging behave correctly
• Backend security review: approved (2 rounds, all findings addressed)

🤖 Generated with Claude Code