Create a new managed specialist agent from a complete definition.

The definition is the whole file: YAML frontmatter between `---` lines, then the system prompt body,
which must not be empty. A minimal definition:

    ---
    name: researcher
    description: Finds and summarises sources on a topic.
    mode: agent
    tools_allow:
      - http_request
      - write_file
    ---

    You research a topic and return a short brief with sources.

Rules the definition has to follow, all enforced before anything is written:

- `name` must be 3 to 30 letters and underscores, and must match the `name` argument.
- `tools_allow` lists exact tool names. Patterns are not accepted, and `tools_deny` is not allowed
  at all, because it grants everything else.
- Every tool you list must be permitted by [orchestration.agent_management].tools_allow. Nothing is
  permitted until the owner lists it there.
- MCP servers are claimed with `mcp_servers`, never through a tool name, and each must be listed in
  the owner's `mcp_servers`.
- `model_provider`, if set, must be a provider the owner listed, or the main configured provider.

The result reports `ok`, the resulting roster, and an `error` naming exactly what to fix when the
definition is rejected. Fix it and call again; a rejected definition is never written.
