Spill oversized fleet-dry reports to a retrievable URI

[TheGreatAxios]

Summary

Fleet-dry clipped worker reports name a tool-output:// spill URI instead of a silent ellipsis. read_file of that URI returns the rest of the report; the inline text says the payload was clipped.

A silent … left the parent with a half-report and no handle to recover the tail, so it invented a blob URI or acted on truncated findings.

• Over-budget fields spill under a fleet-dry: key distinct from leisure {callId}:full.
• writeBlob is awaited before the notice names a URI. A missing or rejected writer yields NOT retrievable with no URI and no unhandled rejection.
• Occupancy stays busy while the spill Promise is in flight, then send() runs with the honest notice.
• Under-budget reports are unchanged.

Verification

• bun run typecheck, bun run build, and bun run test pass
• bun run check passes
• bun test src/subagent/fleet-dry-drive.test.ts covers over-budget spill, async write-before-URI, rejected write, and no silent-ellipsis-only clip

Fixes CL-7616

[linear-code]

CL-7616