feat(swarm): /swarm mode — a standing instruction to fan work out

The `agent_swarm` tool works with the mode off; what the mode adds is the
doctrine — decompose finely, give every member a disjoint scope, do not
do the work yourself. `/swarm`, `/swarm on|off`, `/swarm <task>`, gated
on the tool actually being in the toolset.

Two triggers, not upstream's three. Upstream's `tool` trigger exists so
invoking the tool makes the doctrine appear; kigi's tool carries its own
description and works with the mode off, so that trigger would add a
state only the tool can reach. `Manual` persists until switched off,
`Task` expires at turn end — both are real user intents.

Load-bearing decisions, each from a defect found in review:

- Expiry is a DROP guard, not a post-loop call. A user interrupt aborts
  the turn future rather than cancelling it, so post-loop code never
  runs; three `?` paths skip it too. Either way a `/swarm <task>` mode
  would leak into the next, unrelated prompt.
- `enter` is a total no-op while armed, so the `/swarm <task>` shorthand
  cannot downgrade a standing `/swarm on` into a per-turn mode that then
  disarms itself. This matches upstream; the first cut diverged, and the
  test asserting the divergence was inverted with the fix.
- An explicit `/swarm off` retracts UNCONDITIONALLY. The doctrine rides
  the conversation and so survives a resume, a fork and a compaction that
  an in-memory flag does not; trusting the flag left a session reading
  "off" with the instruction still steering and no way to clear it. That
  also retires the `reminder_live` field, whose doc comment claimed to
  know something the code cannot.
- The mode is deliberately NOT persisted, unlike /goal and /graph: those
  strand real work when lost, this is a prompt hint whose recovery is
  retyping one command. Recorded in AGENTS.md so the omission reads as a
  decision, not a gap.
- The pre-session gate is `subagents_enabled`, not a hardcoded `true`:
  the builder strips `agent_swarm` wherever it strips `task`, and
  advertising it then offers a menu entry that resolves to literal text.
- The exit reminder is as emphatic as the doctrine it revokes; a single
  weak clause is the likelier of the two to be summarised away.

The doctrine rides the existing `push_system_reminder` channel rather
than a second injection path of its own.

crates/codegen/kigi-shell/src/session/acp_session_impl/turn.rs

@@ -217,6 +217,10 @@ impl SessionActor {
         persist_ack: Option<oneshot::Sender<()>>,
     ) -> PromptTurnResult {
         let handle_prompt_start = std::time::Instant::now();
+        // Armed before anything can arm swarm mode, so a `/swarm <task>` mode
+        // is disarmed on EVERY exit from this turn — including the abort a
+        // user interrupt performs, which never reaches post-loop code.
+        let _swarm_turn_guard = self.swarm_turn_guard();
         let prompt_length: usize = prompt_blocks
             .iter()
             .map(|b| match b {
@@ -301,6 +305,13 @@ impl SessionActor {
                     span.record("command_source", "builtin");
                 }
                 match action {
+                    // `/swarm <task>` arms the mode for this turn only and
+                    // sends the task as the prompt, so the doctrine is in the
+                    // conversation before the model reads the work.
+                    BuiltinAction::SwarmTask { prompt } => {
+                        self.apply_swarm_mode(Some(crate::session::swarm_mode::SwarmTrigger::Task));
+                        vec![text_block(prompt)]
+                    }
                     BuiltinAction::GoalSet {
                         objective,
                         token_budget,