Ava must confirm with user before spawning subagents:
- SpawnRequest type with estimates (time, cost, rationale)
- formatSpawnConfirmation to generate prompt
- Two-phase spawn: propose -> confirm -> execute
- Timeout for pending confirmations
See HARDENING.md section 2 for full spec.