Guard cloud child launches missing harness auth

[seemeroland]

Summary

• Deny remote third-party child-agent launches without a managed auth secret or explicit environment inheritance, including autonomous local-agent sessions.
• Preserve explicit "Inherit key from environment" as an allowed auth choice.
• Add regression coverage for autonomous missing-auth denial and explicit inherit behavior.

Tests

• cargo test -p warp run_agents --lib

This PR was created by Oz (running Codex).