feat(agent): RSS-first coding tools and auth foundation - #1

Summary

• Adds the bounded native coding-agent loop with durable provider/tool recovery and scoped capabilities.
• Moves file and process tool orchestration into RSS while retaining host-enforced confinement and resource limits.
• Adds bounded configuration loading, encrypted credential storage, opaque host handles, and generic OAuth authorization-code, refresh, and device primitives.
• Records the production-auth roadmap through Task 3; later production provider exposure remains deferred.

Security properties

• Capability tokens are run-scoped, generation-bound, bounded, and fail closed on replay, expiry, cancellation, or restart.
• Credential and OAuth secrets remain host-owned and are withheld from VM-visible values, JSON, logs, and debug output.
• Transport requests validate authority, path, headers, form ownership, generation, run binding, deadlines, and single-flight consumption before dispatch.

Verification

• cargo fmt --all -- --check
• cargo check --workspace --all-features
• cargo clippy --workspace --all-features --all-targets -- -D warnings
• cargo test --workspace --all-features --all-targets
• Focused config/auth/OAuth/RSS, gateway, runtime capability, file/process, and architecture suites
• GitHub Actions CI passed on the pre-squash tree; the squashed commit preserves that exact tree