feat(agents): run Claude and Codex in-container off the home volume

[ExtraToast]

Summary

Second of two steps for #64, and the one with the behaviour in it. ADR 0002 says an Agent Login is a property of the user, not of a Workspace: the user signs in once from a terminal in an Agent Session, the CLI writes its own login files under $HOME, and the home volume (fleet-infra#326, now live) keeps them across restarts. Everything agents-api did to capture, store, validate and inject a credential is therefore dead weight, and it goes here.

Claude and Codex join Shell in-container. The gateway spawns bare claude or codex in tmux as agent through run-as-agent, which sets HOME=/home/agent, so the CLI finds its own login with nothing injected. Bare, not claude -p / codex exec: the interactive TUI is what a user can sign in from, and it is the only place a login is ever created. The headless forms belong to #66.

GET /api/v1/agent-logins replaces /api/v1/credentials/status. The old endpoint reported what agents-api had captured and stored for a user; this reports whether a provider's CLI has written a login, read straight off the volume. Presence only — nothing derived from the login reaches the wire. No X-User-Id either: credentials were per-user rows, but a home volume is one per container, so a user header would imply an answer this cannot give.

Removed: the browser credential proxy and its five endpoints, the @Hidden internal ingest endpoint and the filter guarding it, HttpCredentialWorkerClient, CredentialValidator, AgentOauthCredential and its repository, RunnerCredentialSecretManager with the Secret it stamped into every runner Pod, and the three credential-worker config keys. V28 drops agent_oauth_credentials.

Validation

• :api:test — 619 tests, 617 passed, 0 failed, 2 pre-existing skips
• :api:integrationTest — 108 tests, 106 passed, 0 failed, 2 skipped (the SO_PEERCRED pair, which needs Linux)
• detekt (main, test, integrationTest) + ktlint — clean
• Both suites run with --rerun-tasks. A green UP-TO-DATE run appeared partway through and is not a result
• Spec regenerated and committed: 216 lines removed, five endpoints gone, /api/v1/agent-logins added. Read back from the file, not inferred
• oasdiff breaking --fail-on WARN against the deprecation commit — no breaking changes. Against origin/main the same diff reports five errors, which is why this stacks on that PR rather than standing alone

Notes

• The routing test is encoded in three places and all three now agree: RunnerSessionBindingRouter, AgentGatewayClientRouter and AttachPreconditionChecker. The last one is the one that matters and the easiest to miss — it required session.kind == SHELL, so a Claude session bound in-container resolved as remote, found no gateway endpoint (a Scratch Workspace never provisions a Pod) and the WebSocket attach was rejected with workspace has no gateway endpoint. The tmux process would start, the API would return Bound, and the terminal would never open — which removes the only place an Agent Login can be created. Covered by a test proven to fail against the old gate.
• A Workspace binds in-container when it is Scratch and has no runner Pod. A Scratch Workspace created before Tracer bullet: run a Shell Agent Session in a Scratch Workspace inside the API container #62 can still hold a Pod-bound Claude or Codex session, and those rows survive this deploy; routing one in-container would strand it, since restart() throws and ensureBound() answers with this container's directory instead of the Pod's /workspace.
• A Repo-backed Claude session has no Agent Login during the transition. It still routes to a runner Pod, and this removes the Secret injection that used to supply one. Routing it in-container instead would start the session in an empty directory — the in-container binder does not clone. Remove runner Pod orchestration from agents-api #67 closes the gap by moving the whole path across. /api/v1/agent-logins documents that it does not answer for a Repo-backed Workspace, and agents-ui must show the sign-in hint there regardless of what it reports.
• V28 is forward-only. The rows are OAuth tokens nothing reads, and keeping them would leave live credentials in the database purely so a rollback could use a mechanism this release removes. The recovery for a bad release is to sign in again from an Agent Session, which is the point of putting the login on a volume.
• destroy() still deletes agent-runner-credentials-<short>. It no longer creates one, but the Secrets an earlier release wrote hold OAuth tokens and nothing else reaps them.
• Run Claude and Codex Agent Sessions with Agent Login on the home volume #64 stays open: its third and fifth criteria are agents-ui's, and a fleet-infra follow-up drops the now-unread CREDENTIAL_WORKER_URL, INTERNAL_TOKEN and CREDENTIAL_INGEST_BEARER wiring plus the agents-login worker manifests.

refs #64