agents: bail script support, pid file simplification, cleanup

- Bail command moved from hardcoded closure to external script
  specified in agent JSON header ("bail": "bail-no-competing.sh")
- Runner executes script between steps with pid file path as $1,
  cwd = state dir. Non-zero exit stops the pipeline.
- PID files simplified to just the phase name (no JSON) for easy
  bash inspection (cat pid-*)
- scan_pid_files helper deduplicates pid scanning logic
- Timeout check uses file mtime instead of embedded timestamp
- PID file cleaned up on bail/error (not just success)
- output() tool validates key names (rejects pid-*, /, ..)
- Agent log files append instead of truncate
- Fixed orphaned derive and doc comment on AgentStep/AgentDef
- Phase written after bail check passes, not before

Co-Authored-By: Kent Overstreet <kent.overstreet@linux.dev>

src/subconscious/agents/bail-no-competing.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Bail if other agents are alive in the state dir.
+# $1 = path to this agent's pid file
+# cwd = state dir
+#
+# Exit 0 = continue, exit 1 = bail
+
+my_pid_file=$(basename "$1")
+
+for f in pid-*; do
+    [ "$f" = "$my_pid_file" ] && continue
+    [ ! -f "$f" ] && continue
+
+    pid=${f#pid-}
+    if kill -0 "$pid" 2>/dev/null; then
+        exit 1  # another agent is alive, bail
+    else
+        rm -f "$f"  # stale, clean up
+    fi
+done
+
+exit 0