Fix quota side-agent handoff projection

[huangruiteng]

Summary

• project configured side-agent handoff targets into quota should-run agent_identity
• keep heartbeat/todo/quota handoff parsing on the same canonical agent_registry helper by breaking the import cycle with lazy registry reads
• extend quota-plan smoke coverage for a side-agent whose handoff reviewer is neither primary nor itself

Validation

• python3 examples/quota-plan-smoke.py
• python3 examples/heartbeat-prompt-smoke.py
• python3 examples/todo-lifecycle-cli-smoke.py
• python3 -m compileall loopx/agent_registry.py loopx/quota.py
• git diff --check

Risk

Low-to-medium runtime projection change: payload consumers may now see an additional agent_identity.handoff_agent field and Markdown line suffix. Existing fields remain intact; no scheduling or todo-complete policy is changed.

[huangruiteng]

Side-agent review for #876.

Findings: no blocking findings.

Product / architecture judgment:

• Motivation: this fixes the side-agent handoff projection gap where quota should-run could show the side-agent identity but not the configured handoff reviewer. That makes a bypass/review lane look like it should return to primary or to itself, even when the project registry declares a separate reviewer.
• Does it solve the problem: yes. The PR projects agent_identity.handoff_agent from the canonical agent registry helper, fails closed if the configured handoff agent is not registered, and adds markdown visibility so heartbeat/status output exposes the route instead of leaving it implicit.
• Specific change review: the lazy import in agent_registry.load_goal_from_registry() is a reasonable way to break the registry/agent_registry cycle; quota.py keeps the new handoff field additive; quota-plan-smoke now covers the important case where the side agent, primary agent, and handoff reviewer are three different agents.
• Mainline risk: low to medium. It touches the quota identity projection hot path, but does not remove existing fields. The main compatibility risk is downstream readers assuming the identity packet has only the old keys; the new field is additive and the smoke covers the routed handoff behavior.
• Overall: I would merge after the normal review gate. I am not admin-bypass merging from the side-agent lane because this touches runtime quota projection, but I do not see a product or architecture blocker.

Validation run on PR head 10a49182 in a clean detached review worktree:

• python3 examples/quota-plan-smoke.py
• python3 examples/heartbeat-prompt-smoke.py
• python3 examples/todo-lifecycle-cli-smoke.py
• python3 -m compileall loopx/agent_registry.py loopx/quota.py
• git diff --check origin/main...HEAD
• python3 -m loopx.cli --format json check --scan-path loopx/agent_registry.py --scan-path loopx/quota.py --scan-path examples/quota-plan-smoke.py

All passed. The LoopX check reported one pre-existing global warning about duplicate run-history index rows for loopx-meta; no public-boundary issue in this PR's changed files.