fix: agent-only announce path, BB message IDs, sender identity, SSRF allowlist (#23970)

* fix(agents): defer announces until descendant cleanup settles

* fix(bluebubbles): harden message metadata extraction

* feat(contributors): rank by composite score (commits, PRs, LOC, tenure)

* refactor(control-ui): move method guard after path checks to improve request handling

* fix subagent completion announce when only current run is pending

* fix(subagents): keep orchestrator runs active until descendants finish

* fix: prepare PR feedback follow-ups (#23970) (thanks @tyler6204)

src/agents/subagent-announce.timeout.test.ts

@@ -53,6 +53,7 @@ vi.mock("./pi-embedded.js", () => ({
 
 vi.mock("./subagent-registry.js", () => ({
   countActiveDescendantRuns: () => 0,
+  countPendingDescendantRuns: () => 0,
   isSubagentSessionRunActive: () => true,
   resolveRequesterForChildSession: () => null,
 }));