#1014 Accept worker codemode runs (worker-runs/v1) with the worker's own authority

SUBC published worker codemode runs in subc-protocol 0.33.3: a run stamp with run_id and on_behalf_of_agent and no agent_id is a worker's (mason's or sidekick's) program. AFT now declares worker-runs/v1.

• A worker run follows its linked parent to AFT's live route bound under that worker scope and runs with that route's root, session, principal, grants, disabled tools, confinement and frozen worker params. The run's own bind root and session, and the head it works for, are never authority; on_behalf_of_agent is attribution only (audit line).
• Its shells get the worker jail, so gh writes and bot speech are refused as for the worker; no consent ask is filed (permission_ask_unavailable).
• Malformed or orphaned worker runs refuse by name with run_owner_not_bound (missing or unlinked parent, parent not a worker scope, no live worker route, delegates or flow present, conflicting attribution).
• subc-protocol =0.33.0 -> =0.33.3.

Tests: a worker run uses the worker's root and frozen params, never the head's; it cannot see or kill the head's bash tasks; each refusal case is refused by name; agent runs are unchanged.