feat(agent): production auth, delivery and tool-plugin integration

[fffonion]

Superseded by the mechanical split

• Production implementation: feat(agent): production auth, workspace and delivery foundation #6 (exact-head CI passed; local Release cancellation investigation remains open; not merged).
• Current tools-plugin/effects integration: feat(agent): tool plugins and effects integration #7 (Draft), dependent on feat(agent): production auth, workspace and delivery foundation #6.
• Native stack: #8, ordered feat(agent): production auth, workspace and delivery foundation #6 → feat(agent): tool plugins and effects integration #7.
• Full original source remains preserved at 9296eff9096f5034bcaf3b2a7a05441beefe8600; the successor Draft restores that tracked source with only the requested Rust 1.99 CI selector difference.

This combined PR is retired without merging.

---

Historical combined-PR description

Supersedes #4

This PR contains the complete commit lineage of #4 plus the subsequent production integration work. Track current review, verification, and remaining CI work here; #4 is superseded rather than a separate merge prerequisite.

Current scope

• RSS-first production authentication/provider wiring, source selection, workspace/session admission, Guardian approval and compaction integration.
• Versioned RSS tool graphs, explicit effect contracts and repository-maintained YAML schemas; immutable prepared code and run-pinned graph identity.
• Production service/HTTP wiring for the six tools, original-pin restore and durable replay, native commit witnesses, cross-call process ownership and bounded cleanup.
• Managed workspace/checkpoint and plugin-state support within the tools-side virtualization scope. No new OS sandbox isolation is claimed.
• Native held-directory standard spawn optimization, shared Program handles with the original checked VM constructor, and one bounded context SELECT/CTE without an added IMMEDIATE write reservation.

Exact current candidate

9296eff9096f5034bcaf3b2a7a05441beefe8600

Independent scoped and cross-delta source reviews are accepted. The exact integrated source was verified locally without changing the original admission deadline, cleanup bound, polling interval, or test assertions:

• Debug: complete 128-target coverage, 2373 PASS / 0 FAIL / 17 existing ignored.
• Release: all 22 required full targets plus relevant feature/IO selections; 27 targets actually executed, 1016 distinct PASS / 0 FAIL / 7 existing ignored. The other 101 Release targets were not executed.
• Original lifecycle target: normal Debug 40/40 and a separate actual-affinity two-CPU workload 40/40. This does not claim universal 250ms behavior or complete GitHub runner equivalence.
• Required all-features/all-targets strict Clippy, fmt, Debug/Release schema executable checks, and default-feature Release binaries passed.
• Known default-only broader strict-Clippy writer_pid limitation remains separate; it is not claimed as passing.

Remaining acceptance

Keep this PR Draft. Remote CI remains failing: exact-head run 39097269278. Local passing results do not replace remote acceptance.

Historical storage cancellation origins remain UNKNOWN. Passing the repaired current candidate does not establish the cause of those earlier failures. No new live-refresh validation or release/deployment claim is made.

No auto-merge is enabled. This superseding relationship does not request a merge into master.

[fffonion]

Production successor #6 is now merged into master (3b6fcc2a7872997799d07a25a7bd91deb51b17b2). PR #4 implemented-feature coverage was verified through the production source and current runtime/CI gates. Current tool-plugin/effects work is preserved separately in Draft #7, now based on master after native restacking. Original combined PR #5 remains closed without merging; the old full source is preserved. Historical SQLite cancellations remain recorded without an unsupported root-cause claim.