subagent: give a run a goal, turns toward it, and a reason it stopped

`start` takes an optional `goal`. With one set a session stops being a
single turn: when a turn ends and nothing has said to stop, the daemon
spawns another turn re-prompting the subagent toward that goal, up to
`max_turns` (default 5, per-session). Without a goal nothing changes —
one turn, one todo, same as before.

Four things end a run, each recorded distinctly and reported by `status`:
the turn ending with no goal, `goal_reached`, `need_help`, and the turn
cap. The last says so out loud rather than stopping quietly — the todo
states the harness limit was reached and the goal was never reported
reached. Every stop extends the done message rather than replacing it,
and lands in the session's report file when it has one. The path is
never inferred: it comes from `start`'s `report_file` or from the
subagent naming where it wrote.

`goal_reached` and `need_help` are the subagent's own, served on a second
route (`/signal/mcp`) that carries those two tools and nothing else, so
reporting on a run can't become starting one. `goal_reached` is built as
a label, never a gate: it is self-reported by a subagent that has just
been re-prompted with "you haven't reached the goal", which is exactly
the incentive to claim it — the same failure class as a build report
asserting the tests pass. Every surface that renders it says so.
`need_help` is the blocking signal, and shows in `status` as its own
state so a parent polling it sees the block without reading a file.

`status` also carries `turn N of M`: with 4330's last-event age, that
separates working from wedged from out of turns off one answer.

Two bugs the new tests caught: a `tokio::fs::File` was dropped without
flushing, so the report line was written to nothing, and the plain idle
answer dropped the turn counter.

Also documents `await_resume`'s third case — a closed channel with no
send, which fails open the same as `Underway` — per argus on #4411.

Refs #4403

CLAUDE.md

@@ -101,12 +101,14 @@ hand-maintained per-file tree drifts out of sync with the code.
 - **`hive-subagent-mcp/`** — per-agent claude-subagent runner daemon
   (`hive-subagent-daemon`); spawns nested claude sessions on request and
   serves `start`/`continue`/`status`/`interrupt` directly over
-  streamable-http (no stdio bridge). Independent of `hive-bash-mcp` (a
-  subagent is a much heavier capability than a bash command). No task
-  files — the daemon's only state is an in-memory map of currently-running
-  processes, live only as long as the process is; the actual claude
-  session survives a daemon restart independently (see `session.rs`'s
-  module doc).
+  streamable-http (no stdio bridge), plus a second subagent-facing route
+  carrying `goal_reached`/`need_help`. Independent of `hive-bash-mcp` (a
+  subagent is a much heavier capability than a bash command). A `start`
+  with a `goal` is a multi-turn run: the daemon re-prompts the subagent
+  toward the goal each time a turn ends, up to a per-session turn cap. No
+  task files — the daemon's state is in-memory only, live only as long as
+  the process is; the actual claude session survives a daemon restart
+  independently (see `session.rs`'s module doc).
 - **`hive-sh4re/`** — shared wire types (Agent / Manager request +
   response, `Message`, `Approval`, `HelperEvent`) used across the unix
   sockets. Host-admin-socket and hive-priv-socket wire types have been