feat(agent): authoring pins the app a deployment file names

[abrichr]

Agent authoring (openadapt-agent serve --authoring) couldn't record a Linux app at all, and on macOS it could pin only the frontmost window. It can now pin whatever app a deployment file names.

What changed

• serve --authoring --config deploy.yaml --authoring-from-config pins the app named by the file's backend: section. This can be a Windows app, one macOS or Linux window, or an RDP or Citrix client window. It uses the same build_backend that openadapt-flow run --config uses, so the recording and its runs drive the same app.
• pin_local_backend(deployment_backend=...) and open_authoring_session(deployment_backend=...) take the section directly.
• For RDP and Citrix, the section's window, title and readiness text go into the recording's backend_hints, so replay binds the same client window.
• Refused:
  • a section plus --url, --windows-agent-url, --remote-window or --citrix ("pin one target");
  • a kind: web section (use --url --headed).
• packages/agent/README.md: one paragraph.

Tests

packages/agent/tests/test_authoring_native.py (factory faked, real Flow AuthoringSession):

• every kind pins with its section's fields;
• the two refusals;
• an agent-driven recording on Linux and on Citrix, with surface and hints in meta.json;
• the serve-side rule for when --config pins.

Result: 19 passed. Locally, 5 tests in test_authoring.py fail on main too, because of this machine's mcp version; CI decides.

Part of the backend parity work (#1282).

🤖 Generated with Claude Code

Review fixes (second commit)

• Opt in with --authoring-from-config. A --config given only for runs no longer pins authoring.
• Network RDP (rdp_host) is refused for authoring, because each run's own session would disconnect the recording's.
• A Windows section without agent_token takes OAFLOW_AGENT_TOKEN, as --windows-agent-url does.
• --remote-window-title now counts as another pin.
• An unreadable deployment file is reported as an authoring error instead of a traceback.
• The README notes that a Linux section needs linux_allow_physical_input: true for agent clicks.