[FEATURE] Add Claude agent harness support

[the-mentor]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow our Code of Conduct

📝 Feature Summary

No response

❓ Problem Statement / Motivation

The ACP sandbox currently ships hermes and openclaw targets. Claude (via Anthropic's Agent SDK) is a widely-used agent that users will want to run inside the same sandbox infrastructure. Adding it as a supported target makes kagent immediately useful for workflows built on Claude.

💡 Proposed Solution

Add a claude Docker target to docker/acp-sandbox/Dockerfile using @agentclientprotocol/claude-agent-acp, a community adapter that wraps @anthropic-ai/claude-agent-sdk and exposes it as a stdio ACP server.

🔄 Alternatives Considered

No response

🎯 Affected Service(s)

None

📚 Additional Context

No response

🙋 Are you willing to contribute?

• I am willing to submit a PR for this feature

[the-mentor]

I already started prototyping Part 1 of the solution in this PR #2189
Part 2 will require adding an Agent Harness of a new type to kagent.

Proposed Solution

Add a claude Docker target to docker/acp-sandbox/Dockerfile using @agentclientprotocol/claude-agent-acp, a community adapter that wraps @anthropic-ai/claude-agent-sdk and exposes it as a stdio ACP server.

Key properties of the Claude target:

• Built on the existing node-base stage (Node ≥22 required)
• No sandbox-local gateway needed — unlike openclaw, claude-agent-acp speaks ACP over stdio directly to the shim, which exposes ws://0.0.0.0:9000/acp externally
• Session state is held in memory, so the child must be long-lived (consistent with the shim's reconnect-grace model)
• ANTHROPIC_API_KEY is injected at runtime by the harness bootstrap — nothing is baked into the image

ACP Handshake Verification

Verified locally at @agentclientprotocol/claude-agent-acp@0.58.1:

{
  "protocolVersion": 1,
  "agentInfo": { "name": "@agentclientprotocol/claude-agent-acp", "version": "0.58.1" },
  "authMethods": []
}

Authentication is via ANTHROPIC_API_KEY — no separate authenticate step required.

[marians]

Related:

• Proposal: add runtime: claude to declarative Agent spec #1676

[the-mentor]

PR #2189 was merged I'm going to start working on the 2nd part.