Refactor subagent and workflow domain models; migrate access tiers and events to domain module

- Moved `AccessTier` and `SubagentEvent` enums to `zesdex_domain::subagent`.
- Consolidated workflow-related types into `zesdex_domain::workflow`.
- Updated references across the codebase to use the new domain models.
- Refactored tool execution logic to utilize a new `ToolExecutor` trait.
- Enhanced `AgentTurnService` to handle tool calls and events more effectively.
- Adjusted API handlers and state management to align with new domain structure.

apps/domain/src/subagent/mod.rs

@@ -0,0 +1,41 @@
+//! Subagent domain models.
+
+/// Events emitted by a running subagent.
+#[derive(Debug, Clone)]
+pub enum SubagentEvent {
+    Started {
+        agent_id: String,
+        directive: String,
+    },
+    ToolCall {
+        agent_id: String,
+        tool_name: String,
+    },
+    ToolResult {
+        agent_id: String,
+        tool_name: String,
+        output: String,
+    },
+    Completed {
+        agent_id: String,
+        output: String,
+    },
+    Failed {
+        agent_id: String,
+        error: String,
+    },
+}
+
+/// Access tier for subagent tool permissions.
+///
+/// Tiers are cumulative: `Write` includes everything in `Read`, and `Full`
+/// includes everything in `Write`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AccessTier {
+    /// Read-only: search, read, glob, utility tools (no mutations).
+    Read,
+    /// Read + Write: above plus write, edit, delete, git, memory.
+    Write,
+    /// Full: above plus bash, shell, LSP, workflow, plan tools.
+    Full,
+}