Add ACP CodingAgentRun bridge

[yyjeqhc]

Summary

Add the first WebCodex ACP coding-agent integration as a Codex-first CodingAgentRun vertical slice.

This PR includes the reviewed P0 architecture contract, the P1 implementation/review closure, and the final cross-platform Project/snapshot identity hardening. The product model is a protocol-aware detached execution object: WebCodex owns a durable CodingAgentRun, while the private ACP session remains Runner-local.

What this adds

• model-facing coding_agent_start, coding_agent_observe, and coding_agent_cancel
• closed typed Server <-> Runner CodingAgentRun protocol
• Runner-owned ACP provider manager and provider-instance fencing
• official Codex ACP adapter integration via @agentclientprotocol/codex-acp
• exact registered Project cwd binding using the existing platform-aware canonical path identity contract
• native-config inheritance by default; optional advertised config overrides remain operator-ceiling bounded
• bounded structured ACP observation with opaque continuation tokens and explicit history-loss semantics
• cancellation, timeout, provider replacement, Runner restart, and Server restart reconciliation
• fail-closed session/request_permission handling; P1 never auto-allows and does not expose a public permission-response tool
• durable prompt-dispatch uncertainty barrier: post-barrier recovery never blindly re-dispatches
• body-free Workflow Session provenance/audit for CodingAgentRun lifecycle
• dedicated coding_agent:run OAuth scope; legacy/default/shared-key authority does not receive it implicitly

Independent review closure

Independent review and native CI found and closed the following correctness gaps in separate follow-up commits:

• use replace-existing durable state publication on Windows rather than Unix-only rename semantics
• isolate malformed/missing per-Run durable state as a fail-closed tombstone instead of disabling the whole ACP manager
• preserve OutcomeUnknown across real manager restart for damaged post-dispatch state, with no duplicate prompt
• canonicalize equivalent credential transports to the same underlying CodingAgentRun authority (shared-key direct/OAuth bridge, managed-user PAT/OAuth, project-grant credential/OAuth subject)
• attach recording_session_id only after idempotent intent/project checks succeed
• bound Server terminal-run retention to match Runner retention behavior
• bound permission waiting by the overall Run deadline
• fence start/observe/cancel and restart reconciliation by exact Run authority, intent, Project, provider and provider-instance identity
• require project:write plus coding_agent:run and a currently writable Project for start, while observe/cancel retain the narrower authority contract
• replace raw Path equality in ACP Project binding with the existing canonicalize_existing + platform-aware paths_equal contract, covering macOS /var vs /private/var, Windows case/verbatim identity, and symlink-retarget fail-closed behavior
• add one shared semantic CodingAgentRun snapshot validator used by normal response validation, registration inventory validation, and Runner durable-record validation; contradictory or unknown terminal truth now fails closed

Validation

Final head: 93d11c170aa0604baaf8485979101b22f8bce88d (Harden ACP native project and snapshot identity).

Special/Linux focused validation:

• cargo test --locked -p webcodex-core coding_agent: 4 passed / 0 failed
• Runner ACP deterministic tests: 15 passed / 0 failed / 1 ignored
• Server CodingAgentRun/OAuth/authority tests: 16 passed / 0 failed
• cargo check --all-targets: passed
• cargo fmt -- --check: passed on final tree
• git diff HEAD^ --check: passed

Native macOS validation on mini at the exact final SHA:

• prior failing Project-binding test: passed
• full ACP Runner test group: 16 passed / 0 failed / 1 ignored, including /var vs /private/var
• full Runner suite: 772 passed / 1 failed / 9 ignored; the sole failure is the unrelated lsp_initialize_timeout_cleanup_uses_configured_shutdown_budget test and was reproduced unchanged on main (5fa2aafb), so it is not introduced by this PR

Native Windows validation on MSI at the exact final SHA:

• prior sole failing Project-binding test: passed
• Windows-applicable ACP Runner tests: 3 passed / 0 failed, including case/verbatim path identity
• full Runner suite: 699 passed / 0 failed / 8 ignored

GitHub Actions CI run for the exact final SHA is green across contract, Linux workspace crates, Linux server, Linux runner, Windows, macOS, and the aggregate gate.

Real opt-in Codex ACP dogfood from the implementation round also completed successfully against official @agentclientprotocol/codex-acp 1.6.2, observing normalized activity/message events and end_turn -> completed.

Security / authority notes

• callers never provide provider executable paths, argv, environment, credentials, or arbitrary transport configuration
• provider configuration and environment mapping remain Runner/operator owned
• Project cwd is an execution target identity, not a filesystem sandbox claim
• ACP private session IDs stay Runner-private
• permission callbacks fail closed and are bounded/cancelable
• Runner/provider replacement is fenced; uncertain prompt outcomes become lost / outcome_unknown rather than retry authority
• coding_agent:run is an independent delegated authority and is never inferred from existing project/shell/MCP scopes
• ordinary audit/telemetry/lifecycle metadata does not persist prompt, config body, reasoning, agent messages, raw ACP traffic, or credentials

Non-goals

This PR intentionally does not add:

• Claude ACP adapter
• public permission-response capability
• generic ACP/plugin framework
• Browser Session API
• Room / Discussion / Participant / presence / typing
• scheduler / worker pool / automatic worker spawning / orchestrator
• durable operation DAG
• tool slimming
• ACP v2 / experimental protocol extensions

Commit stack

• bf5a86ee Define ACP Coding Agent Run contract
• 44a1243f Harden ACP Coding Agent Run contract
• 766410b0 Implement ACP CodingAgentRun vertical slice
• 205f0dd6 Harden ACP CodingAgentRun review gaps
• 36e0f577 fix: close ACP run authority and identity gaps
• 93d11c17 Harden ACP native project and snapshot identity