feat: coordinator audit-loop wiring at merge point

Parent audit loop sits after all children are aggregated and
before the parent final state; the single-task _audit_loop_wire
is never applied to parents or children. Parent gates are
per-child gates child:<name> (completed only); execution
failures map to one deterministic finding per child; subjective
findings are split off before evaluate and only audited as
needs_review. Gate-rejected children (capability/tool/approval
audit rows, or distinctive error markers) bypass evaluate and
escalate directly without consuming a round; tolerated, paused
and quota-missing parts are excluded, never findings. Rounds
are counted only in the parent task_audit_loop_state; on
pushback the packet is stored on the parent and split per failed
child into that child's audit_loop_packet column, consumed once
by the existing packet-injection path at next claim; pass and
escalate clear parent and child packets. POST /tasks now allows
audit_loop on coordinator parents (the old 400 rationale is
gone); children still take no external switch.

cloud/server.py

@@ -4915,10 +4915,14 @@ class CloudControlPlaneHandler(BaseHTTPRequestHandler):
                              " goal/coordinator tasks"})
                 return
         # 审计循环接线：audit_loop 只认 True/1（其它真值一律
-        # 400，不猜）；协调员父任务不跑模型回合、接线覆盖不到
-        # 它，带 audit_loop 建协调员任务属于静默丢弃，同款
-        # v9 拒绝逻辑，400 且不建任务。goal 任务允许（goal
-        # 校验门是接线要消费的确定性门之一）。
+        # 400，不猜）；协调员父任务自协调员接线轨起允许携带
+        # 开关（合流点在子任务汇总后、父任务终局前调审计循环，
+        # 不再是“接线覆盖不到”的情形——此前拒绝的理由已消除，
+        # 见 worker._coord_audit_loop_merge）。子任务仍不直接
+        # 接受外部开关：子任务由 worker 内部 INSERT 创建，本来
+        # 就不写 audit_loop 列（默认 0），父任务的循环只记在
+        # 父任务上，子任务包只是前言载体。goal 任务允许（goal
+        # 校验门是单任务接线要消费的确定性门之一）。
         audit_loop_val = 0
         if body.get("audit_loop") is not None:
             if body.get("audit_loop") not in (True, 1):
@@ -4926,11 +4930,6 @@ class CloudControlPlaneHandler(BaseHTTPRequestHandler):
                     "error": "audit_loop must be true or 1"})
                 return
             audit_loop_val = 1
-            if coord_parts:
-                self._send_json(400, {
-                    "error": "audit_loop cannot be used with"
-                             " coordinator tasks"})
-                return
         agent_name_val = definition.name if definition else None
         agent_version_val = definition.version if definition else None
         agent_instructions_val = (