Let a device's runtime-mode cap apply only on that device, not to cross-device sessions

[PanRagon]

Setup

Two linked environments with different blast radius:

• device-1 has a high blast radius. Its policy caps it at auto and turns off terminal use, so no session there can run arbitrary commands.
• device-2 is sandboxed. Running at full-access is fine there.

Problem

A session on device-1 runs at auto, so T3 refuses to let it message or delegate to a full-access session on device-2:

runtime_mode_escalation_denied:
Child runtime mode full-access is broader than parent mode auto.

device-1 is capped so that nothing runs with full access on device-1. Work running on device-2 can't touch device-1. Today, though, the cap on device-1 also limits what its sessions can ask device-2 to do, even when the link to device-2 allows full access.

Ask

An opt-in setting that skips the parent-mode check for cross-device sessions only:

• A child on another device is limited by that device's ceiling (its policy and the link's access level), not by the caller's mode.
• Same-device children keep today's rule: never broader than the parent.
• Anything that comes back to device-1 stays capped by device-1's own ceiling.

So a mode cap stays where it belongs: it blocks risky work from running on the device it protects, without blocking that work on a sandboxed device built for it.

Related

• Let an Auto thread send to a Full access thread after the user approves that one message #22975: approve a single send from an Auto session to a Full-access one.
• Per-task runtime policy and workspace options for delegated children (provider-agnostic) #20425: per-task runtime policy for delegated children.