feat: implement subagent tool gating and timeout mechanisms for enhanced security and performance

src/service/provider.rs

@@ -199,7 +199,10 @@ impl LlmClient {
         };
 
         let url = format!("{}/chat/completions", self.base_url);
-        let max_retries = 10;
+        // Fewer retries on streaming because `run_agent_turn` has a
+        // non-streaming fallback that also retries. Combined total is
+        // capped implicitly by the per-turn timeout and step limits.
+        let max_retries = 3;
         let mut attempt = 0;
         let mut started = false;