feat(agent): RSS-first coding tools and auth foundation (#1)

Add bounded coding tools, RSS-owned orchestration, scoped capabilities, configuration and credential foundations, and generic OAuth flows through Task 3.

Author: fffonion

.github/workflows/ci.yml

@@ -25,11 +25,6 @@ env:
   # repository is required or used (tests/dependency_pin_tests.rs enforces
   # the canonical source and full revision; bump only together with a
   # Cargo.lock refresh).
-  # Integration tests place temporary SQLite state and fixture scripts
-  # here. Every suite honors this variable; without it they fall back to
-  # /mnt/TEMP/rustscript/... which is the local-development default and
-  # not writable on CI runners.
-  RUSTSCRIPT_AGENT_TEST_TMP: ${{ runner.temp }}/rustscript-agent-tests
 
 jobs:
   quality:
@@ -41,6 +36,14 @@ jobs:
         # (actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5).
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
+      # Integration tests honor RUSTSCRIPT_AGENT_TEST_TMP for SQLite state and
+      # fixture scripts; without it they fall back to /mnt/TEMP/rustscript/...
+      # which is not writable on CI runners. `runner` is unavailable in
+      # workflow-level and job-level `env`, so export the runner default
+      # RUNNER_TEMP path from a step instead.
+      - name: Configure test temp root
+        run: echo "RUSTSCRIPT_AGENT_TEST_TMP=${RUNNER_TEMP}/rustscript-agent-tests" >> "$GITHUB_ENV"
+
       - name: Install Rust toolchain
         # Full-SHA pin, matching the rustscript-lang/rustscript CI policy
         # (dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30).