M5 — List jobs + subscribe + agent versioning

[nficano]

Goal

List jobs + subscribe + agent versioning — cross-session observation surface.

Scope

• session.list_jobs / session.jobs with cursor
• Per-principal visibility enforcement in JobManager::list()
• job.subscribe / job.subscribed / job.unsubscribe
• SubscriptionManager reworked: principal-scoped, history replay via from_event_seq
• Subscriber cannot cancel (client-side block + runtime-side PERMISSION_DENIED on raw envelope)
• name@version parsing via AgentRef::parse()
• AgentVersionNotAvailableException
• ListJobsTest, SubscribeTest, AgentVersionsTest
• Samples: samples/list-jobs/, samples/subscribe/, samples/agent-versions/
• Diagrams: extended job-fsm.dot with subscribe-observer states
• docs/concepts/subscribe.md, docs/guides/agent-versioning.md

Spec §

§6.6, §7.5, §7.6

Gate

Cross-principal isolation test asserts exact job_id set (no leakage).