fix: agent-only announce path, BB message IDs, sender identity, SSRF allowlist (#23970)

* fix(agents): defer announces until descendant cleanup settles

* fix(bluebubbles): harden message metadata extraction

* feat(contributors): rank by composite score (commits, PRs, LOC, tenure)

* refactor(control-ui): move method guard after path checks to improve request handling

* fix subagent completion announce when only current run is pending

* fix(subagents): keep orchestrator runs active until descendants finish

* fix: prepare PR feedback follow-ups (#23970) (thanks @tyler6204)

src/agents/subagent-registry.announce-loop-guard.test.ts

@@ -156,6 +156,41 @@ describe("announce loop guard (#18264)", () => {
     expect(stored?.cleanupCompletedAt).toBeDefined();
   });
 
+  test("expired completion-message entries are still resumed for announce", async () => {
+    announceFn.mockReset();
+    announceFn.mockResolvedValueOnce(true);
+    registry.resetSubagentRegistryForTests();
+
+    const now = Date.now();
+    const runId = "test-expired-completion-message";
+    loadSubagentRegistryFromDisk.mockReturnValue(
+      new Map([
+        [
+          runId,
+          {
+            runId,
+            childSessionKey: "agent:main:subagent:child-1",
+            requesterSessionKey: "agent:main:main",
+            requesterDisplayKey: "agent:main:main",
+            task: "completion announce after long descendants",
+            cleanup: "keep" as const,
+            createdAt: now - 20 * 60_000,
+            startedAt: now - 19 * 60_000,
+            endedAt: now - 10 * 60_000,
+            cleanupHandled: false,
+            expectsCompletionMessage: true,
+          },
+        ],
+      ]),
+    );
+
+    registry.initSubagentRegistry();
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(announceFn).toHaveBeenCalledTimes(1);
+  });
+
   test("announce rejection resets cleanupHandled so retries can resume", async () => {
     announceFn.mockReset();
     announceFn.mockRejectedValueOnce(new Error("announce failed"));