fix(web-app,agent-presets): keep the task registry on the host plane

`tool-bash` resolves the background-task registry with `ctx.get('tasks')`,
and it sits at the preset's top level. The registry sat inside an
entry-local `isolate: { tasks: true }` realm, which is invisible to every
sibling row outside it, while the Web surface disabled the host row — so
both lookups missed and every `run_in_background` call answered
"background tasks unavailable" with `task_output`, `task_list`, and
`task_kill` still listed in the catalog. `task_list` returning
"(no background tasks)" is what made the outage read as an empty queue
rather than a severed producer.

That is the `goals` criterion read from inside the preset: a Service a row
outside its realm READS belongs to the plane both can see. `tasks` already
keys access by owning agent (`assertAccess` compares `task.owner.id`) and
mints an independent token per `attachSurface` call, so one host instance
serves every session exactly as before presets — the per-preset-standing-mounts
note records that sharing `tasks-local` is a return to its design.

`minimal` mounts no `tool-tasks`, and the `start()` control-surface gate is
a service-wide set that another preset's controls would open for it, so its
`tool-bash` disables `run_in_background` and drops the parameter from the
schema.

Fixes #2141

apps/cli/config/agent-presets/code/agent.cordis.yml

@@ -70,17 +70,15 @@
 
 # ── background tasks ────────────────────────────────────────────────────────
 
-- id: tasks
-  name: cordis:group
-  group: true
-  isolate:
-    tasks: true
-  config:
-    - id: tasks-local
-      name: '@deepseek-ai/dsh-tasks-local'
-
-    - id: tool-tasks
-      name: '@deepseek-ai/dsh-tool-tasks'
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background tasks
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-tasks
+  name: '@deepseek-ai/dsh-tool-tasks'
 
 # ── skills ──────────────────────────────────────────────────────────────────
 

apps/cli/config/agent-presets/cordis/agent.cordis.yml

@@ -64,17 +64,15 @@
 
 # ── background tasks ────────────────────────────────────────────────────────
 
-- id: tasks
-  name: cordis:group
-  group: true
-  isolate:
-    tasks: true
-  config:
-    - id: tasks-local
-      name: '@deepseek-ai/dsh-tasks-local'
-
-    - id: tool-tasks
-      name: '@deepseek-ai/dsh-tool-tasks'
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background tasks
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-tasks
+  name: '@deepseek-ai/dsh-tool-tasks'
 
 # ── goals ───────────────────────────────────────────────────────────────────
 

apps/cli/config/agent-presets/minimal/agent.cordis.yml

@@ -22,8 +22,16 @@
 # never reached the model's shell at all. `tool-bash` consumes the host registry
 # from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
 # sandbox policy owns it.
+#
+# `run_in_background` is off because this preset mounts no `tool-tasks`: the
+# host task registry gates starts on SOME control surface being attached, and
+# that set is process-wide, so another preset's controls would let this agent
+# start work it has no `task_output` to collect. Disabling drops the parameter
+# from the schema too, which is the honest surface for a two-tool benchmark.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
+  config:
+    enableRunInBackground: false
 
 - id: tool-str-replace-editor
   name: '@deepseek-ai/dsh-tool-str-replace-editor'

apps/cli/config/agent-presets/standard/agent.cordis.yml

@@ -63,17 +63,15 @@
 
 # ── background tasks ────────────────────────────────────────────────────────
 
-- id: tasks
-  name: cordis:group
-  group: true
-  isolate:
-    tasks: true
-  config:
-    - id: tasks-local
-      name: '@deepseek-ai/dsh-tasks-local'
-
-    - id: tool-tasks
-      name: '@deepseek-ai/dsh-tool-tasks'
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background tasks
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-tasks
+  name: '@deepseek-ai/dsh-tool-tasks'
 
 # ── skills ──────────────────────────────────────────────────────────────────