fix(jobs): route queued agents to combined serve jobs API

[sketchius]

queue_agent and wait_for_jobs built their jobs URL from TERM_LLM_JOBS_SERVER (default http://127.0.0.1:8080) and stripped any trailing /ui or /chat. A combined serve web jobs process mounts the jobs API under its base path and redirects the root to the UI, so queuing from a web chat failed (POST /v2/jobs → 307 → HTTP 405). The only workaround was a separate root-mounted serve jobs process. With that, completion notices can't reach the live web session: they're only appended to the session store, so notify_when_done never steers a running turn or starts an idle one.

A serve process that runs jobs now binds the queued-job tools it creates to its own address, mounted base path and bearer token, so combined serve web jobs needs no jobs environment variables and keeps notifications in-process. Outside a combined server, TERM_LLM_JOBS_SERVER is now used exactly as given, so an explicit /ui or custom base path works as the job-runner guide describes. The guide documents both cases.

Testing

• Regression tests:
  • combined-server job creation with the originating web session attached for notification;
  • explicit /ui and /chat base paths for queue_agent and wait_for_jobs;
  • jobs URL resolution, including wildcard binds.
• make build, go test ./..., go vet ./..., go mod tidy -diff (all modules), make complexity, and CI's web lifecycle race targets.
• Manual, single serve web jobs --approval prompt:
  • jobs queue from a web chat;
  • a mid-turn notify_when_done reaches the model, which quotes a marker only present in the job output without calling wait_for_jobs;
  • an idle chat gets a continuation turn about 5 s after the job finishes;
  • queued jobs still fail closed in an unconfirmed workspace.
• Manual, explicit TERM_LLM_JOBS_SERVER: it still works with a separate jobs server, and with a combined server at /ui.

Notes

• Compatibility: removing the /ui//chat trimming means a TERM_LLM_JOBS_SERVER that points at a standalone serve jobs but includes /ui will now 404. That's intentional: the URL is treated as the exact API base. Happy to keep a fallback if you'd rather.
• Known follow-up, not changed here: with claude-bin, a mid-turn notice is delivered through the existing native-interrupt steering path, so it cancels the tool call in progress. A self-hosted/OpenAI-compatible provider handled the same notice between tool calls. Deferring notices until the current tool call finishes would be a separate change.
• Not covered: when serve binds a specific non-loopback address, jobs queue but notifications are dropped, because notify origins are only trusted from loopback requests.

[SamSaffron]

I am reworking a lot of this, I just merged a much smarter and more complete spawn agent, this will mean that usage of queue agent will be quite rare.

happy to merge this in the interim but we have a merge conflict.

[SamSaffron]

actually looks like it is easy enough to merge ...

[SamSaffron]

Integrated into main with the duplicate childRuns field fixed; build, tests, vet, and complexity
checks pass.