Live feed:
- Sub-agents (depth > 0) display with "└" indent prefix
- Agent column widened to 20 chars for indent space

Event detail:
- Shows "Parent: <agent>" when event is from a sub-agent
- Shows "(sub-agent, depth N)" next to agent name
- Empty lines suppressed when no parent

- TraceStep now carries ParentAgent and AgentDepth from audit entry
- Session trace timeline shows "sub-agent" tag (not "agent") when
  depth > 0, with muted color to indicate lower responsibility
- Builds on hierarchy data populated by hooks handler

Root cause: Claude Code sets X-Oktsec-Agent header to "claude-code"
for ALL events, but resolves agent names in the JSON body (via
agent_type or config matching). The header is always the root agent.

Fix: compare the resolved agent name (ev.Agent) with the header
value. If they differ, the event is from a sub-agent. Set
parentAgent = header value, depth = 1.

Also: only set Agent from header if the JSON body didn't provide
one (prevents header from overwriting body-resolved agent names).

Query: auditSelectCols now includes parent_agent, agent_instance_id,
root_agent, agent_depth. Scan reads all 4 new columns.

Without this, TraceStep.AgentDepth was always 0 because the Query
method never read the fields from the DB, even though they were
written correctly.

TUI: event detail uses dynamic line array instead of JoinVertical
with empty strings, preventing blank line when no parent agent.

Agent detail page:
- Shows "Sub-agent of: claude-code" with link for sub-agents
- Shows "Sub-agents spawned: explore (10 calls), plan (6 calls)"
  as clickable cards for parent agents
- Data from agent_hierarchy table aggregated by agent name

Store:
- Uses existing DB() method for direct hierarchy queries

TUI:
- Event detail uses dynamic line array to prevent empty line
  when no parent agent exists