fix(subagent): enumerate failure statuses explicitly instead of negating accepted

Greptile review on PR 68726 flagged that result.status !== "accepted" would
silently enroll any future non-accepted status (e.g. queued/pending) into the
role-augmentation path. Switch both the ACP and subagent forward sites to an
explicit enumeration of (error | forbidden) so new upstream statuses must
opt in deliberately. Behavior unchanged for today's closed union.

src/agents/tools/sessions-spawn-tool.ts

@@ -313,10 +313,9 @@ export function createSessionsSpawnTool(
             });
           }
         }
+        const isAcpFailure = result.status === "error" || result.status === "forbidden";
         return jsonResult(
-          result.status !== "accepted" && requestedAgentId
-            ? { ...result, role: requestedAgentId }
-            : result,
+          isAcpFailure && requestedAgentId ? { ...result, role: requestedAgentId } : result,
         );
       }
 
@@ -355,10 +354,9 @@ export function createSessionsSpawnTool(
         },
       );
 
+      const isSubagentFailure = result.status === "error" || result.status === "forbidden";
       return jsonResult(
-        result.status !== "accepted" && requestedAgentId
-          ? { ...result, role: requestedAgentId }
-          : result,
+        isSubagentFailure && requestedAgentId ? { ...result, role: requestedAgentId } : result,
       );
     },
   };