Nothing deletes the key of a finished task, so the bucket would grow with every
task an agent runs. The shared bucket helper takes an optional max age, applied
when the bucket is created; a live task's republishing keeps its own key.
A status key per task in the bash-task-status bucket and the task's output rows
in a per-agent stream, kept apart as for subagents. The controller creates the
bucket and the streams, and the agent credential may publish its own keys and
subjects. Nothing publishes yet; the bash MCP half follows.
