feat(#704): add <children> recipient sentinel — fan-out to direct descendants

docs/conventions.md

@@ -93,11 +93,18 @@ angle-bracket and asterisk shapes below are structurally safe.
   a root agent (or absent from topology entirely). Lets agents address
   their parent without learning the label, so runtime reparenting
   propagates with zero agent-side restart.
+- `<children>` — fan-out to every direct descendant of the sender per
+  `topology.json`. Resolved in `agent_server::handle_send` via
+  `topology::children_of(sender)`: one message is delivered to each
+  child, bypassing the allow-list check (structural fan-out targets are
+  never user-listed peers). No-op for leaf agents (returns `Ok` when the
+  child set is empty). Lets a sub-manager nudge its subtree without
+  enumerating labels.
 
-When the resolver rewrites `<parent>`, the broker stores the
-*resolved* label as the message's recipient — the dashboard and
-recv side both see the real route. The sentinel is purely a
-send-time addressing convenience.
+When a `<children>` or `<parent>` send resolves to real recipients, the
+broker stores the *resolved* label(s) as the message recipient(s) — the
+dashboard and recv side see the real routes. The sentinels are purely
+send-time addressing conveniences.
 
 ## Wire protocol