feat(cli): agent spawn — atomic locked-down throwaway session (#1217)

[jvsteiner]

Linked Issue

Closes #1217 (built on #1383).

Summary

Adds astrid agent spawn: one bounded job under a newly derived, restricted principal, followed by reclaiming teardown. The derived runtime receives only explicitly named WASM capsule installs, capsule-scoped state, user-invocable capsule grants, and outbound endpoints. Nothing else is inherited implicitly.

Changes

• Add astrid agent spawn --job ... with explicit --load-capsule, --allow-capsule, --inherit-capsule-state, and --allow-egress controls.
• Make restricted authority an invariant: spawn exposes no arbitrary capability-grant flag and always provisions the built-in restricted group.
• Add a dedicated additive admin.agent.derive request topic and client method rather than adding a variant to the exhaustive public AdminRequestKind enum.
• Reject duplicate or inconsistent capsule selections, malformed egress, residual target state, and host-MCP/native-process capsule installs.
• Materialize only selected capsule installs and copy env, KV, and declared secrets only for explicitly selected capsule namespaces.
• Enforce restricted-principal network and process policy again at host-call time.
• Authenticate the job uplink as the derived principal, auto-deny approval requests, apply a wall-clock timeout, and send cooperative cancellation before teardown.
• Roll failed provisioning back through the ownership deletion guard so concurrent fleet assignment cannot leave ownership pointing at deleted identity state.
• Tear down through refactor(kernel): AgentDelete always reclaims a deleted principal's footprint (#1217) #1383's reclaiming AgentDelete; --keep remains an explicit debugging escape hatch.

Verification

• cargo fmt --all -- --check
• cargo test -p astrid-core kernel_api::agent -- --nocapture
• cargo test -p astrid-kernel additive_derive_endpoint_preserves_correlation_and_authorization -- --nocapture
• cargo test -p astrid-kernel state_tests_agent_derive -- --nocapture
• cargo test -p astrid-capsule restricted -- --nocapture
• cargo test -p astrid agent::spawn -- --nocapture
• cargo clippy -p astrid-core -p astrid-uplink -p astrid-kernel -p astrid-capsule -p astrid --all-targets --all-features -- -D warnings

The CLI e2e manifest includes the command, but a live harness/provider spawn-run-teardown proof remains required before this leaves draft.

AI / Tool Assistance

Assisted-by: OpenAI Codex: GPT-5

Codex helped reconstruct the patch on current code, identify and remove the capability-escalation path, preserve public Rust API compatibility with an additive endpoint, integrate fleet-ownership-safe rollback, add focused regressions, and run the validation above. The resulting authority and compatibility changes were reviewed against the current kernel, ownership, and uplink implementations.

Checklist

• Linked to an issue
• CHANGELOG.md updated (entry under [Unreleased] — or [Unreleased] rolled into a version section for a release PR; not applicable to docs/CI-only changes)
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested any meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.

[jvsteiner]

@joshuajbouw ready for review — agent spawn: atomic locked-down throwaway session composing shipped primitives. Second of two for #1217; stacked on #1383 (diff includes it until that merges).

[joshuajbouw]

Review outcome: not ready to advance; please keep this as draft or rework it. The “locked-down” guarantee is not enforced as an invariant because callers can supply --group; the live run/warm-up path is not demonstrated; and teardown depends on best-effort purge. Please land or resolve the purge design first, constrain the security surface, provide live end-to-end evidence, and fix the required PR template/changelog. I have not approved the currently gated workflows.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.