Function ResolveHandoffTarget

Resolves and validates a handoff target agent in deterministic order:

1. NotFound — no Active agent with that name (trimmed, case-insensitive), or ContextUser lacks 'view' permission on it.
2. Self — the target is the source agent (SourceAgentID).
3. NotDiscoverable — !AIAgentPermissionHelper.IsDirectlyDiscoverable(target).
4. NotAllowedHere — HostAllowedIDs is present and the target is not in it.
5. NoRunPermission — AIAgentPermissionHelper.HasPermission(target.ID, ContextUser, 'run') is false or throws (fail closed).
6. AlreadyInThisTurn — the target is already in HandoffChain (prevents ping-pong and longer cycles).
7. HopLimit — HandoffChain.length + 1 > MAX_HANDOFF_HOPS.

When multiple Active agents share the requested name, matches are ordered by NormalizeUUID(ID) and checked in order, resolving to the first match that passes all checks and refusing with the first viewable match's failure reason only when none passes.

At most one handoff per user turn per source is enforced naturally because a successful Handoff ends the source agent's run.