fix(execution): grouped sub-agent edited args validated, abort ends wedged tool waits, re-pause keeps approvalIds (Eve2-F4/F5/F6)

[LinuxDevil]

Fixes three findings from the second adversarial audit (audit/eve2), all in the approval/abort resume path. All repros verified against this branch.

Eve2-F4 — grouped sub-agent edited args skip schema validation (High)

groupDecision() stored decision.args raw for snapshot.subagent records (the lead's registry holds none of the sub-agent's tools), so an invalid edit like { a: 'not-a-number' } reached execute() unchecked. decideGroupMember() now runs validateGroupArgs() once every call of the step is decided — inside the sub-agent's own resume, against the registry that owns the tools — and replaces each decision's args with the parsed output, like withEditedArgs() does for a single call. An invalid edit throws LOUSHO_TOOL_ARGS_INVALID and the claimed record goes back, so the approval stays pending.

• Repro: npx tsx audit/eve2/repro/subagentGroupEditedArgs.ts → "OK: edited args were validated/rejected"
• Regression tests: src/parallelApprovals.test.ts (invalid args rejected, valid args run)

Eve2-F5 — abort during tool execution never settles the run (High)

Two tool waits were not raced against the run's signal the way the model call already is (Eve CORE-F15): Promise.all(this.running) in ToolBatch and executeApprovedTool() in resume.ts. A signal-ignoring/wedged tool left send(), stream() and approvals.resolve() pending forever.

• ToolBatch.settled() races the running calls against the run signal; when the abort side wins after a one-turn drain (so a settlement already landing still records — a tool released just as the run aborted keeps its result), still-running calls are reported unrecorded and get the same 'cancelled' result as calls never reached. Late settlements record nothing on top.
• executeApprovedTool() waits on abortableToolCall(), the same drain-aware race, so a tool that aborts the signal inside its own execute() still returns its real result.
• The underlying tool keeps running (documented for ExecuteOptions.signal); the run ends finishReason: 'aborted' with abortReason, through the existing abortRun() path.
• Repros: abortDuringToolExecution.ts → resolved finish=aborted in ~173ms; abortDuringResumedTool.ts → resolved finish=aborted in ~167ms.
• Regression tests: src/execution/abortEdges.test.ts (wedged tool in a batch; wedged approved tool on resume)
• docs/runs.md updated: a signal-ignoring tool is no longer "waited for".

Eve2-F6 — re-paused run's checkpoint drops approvalIds (Medium-High)

markAwaitingApproval() wrote only approvalId, so a run re-pausing on several of a step's calls (e.g. a resumed sub-agent pausing again) showed durable readers 1 of N pending approvals. It now carries approvalIds like markGroupPending() does.

• Repro: rePausedSubagentCheckpointIds.ts → "OK: checkpoint names every pending approval"
• Regression test: src/execution/approvalResumeDurability.test.ts

Verification

• npx vitest run src/execution: 73 files / 1064 tests pass (incl. parallelApprovals 14, abortEdges 9, approvalResumeDurability 4)
• npx vitest run on resume/approval consumers outside src/execution (cloudflare checkpoint, kvCheckpointStore, publicSurface, SqliteStore): 178 tests pass
• npx tsc --noEmit -p tsconfig.json: clean
• npm run lint: clean
• CHANGELOG: one line per fix tagged (Eve2-F4/F5/F6)