feat(cli): agent spawn — atomic locked-down throwaway session (#1217)

[jvsteiner]

Linked Issue

Closes #1217 (built on #1383).

Summary

Adds astrid agent spawn: one bounded job under a newly derived, restricted principal, followed by reclaiming teardown. The derived runtime receives only explicitly named WASM capsule installs, capsule-scoped state, user-invocable capsule grants, and outbound endpoints. Nothing else is inherited implicitly.

Changes

• Add astrid agent spawn --job ... with explicit --load-capsule, --allow-capsule, --inherit-capsule-state, and --allow-egress controls.
• Make restricted authority an invariant: spawn exposes no arbitrary capability-grant flag and always provisions the built-in restricted group.
• Add a dedicated additive admin.agent.derive request topic and client method rather than adding a variant to the exhaustive public AdminRequestKind enum.
• Reject duplicate or inconsistent capsule selections, malformed egress, residual target state, and host-MCP/native-process capsule installs.
• Materialize only selected capsule installs and copy env, KV, and declared secrets only for explicitly selected capsule namespaces.
• Enforce restricted-principal network and process policy again at host-call time.
• Authenticate the job uplink as the derived principal, auto-deny approval requests, apply a wall-clock timeout, and send cooperative cancellation before teardown.
• Roll failed provisioning back through the ownership deletion guard so concurrent fleet assignment cannot leave ownership pointing at deleted identity state.
• Drain admitted host effects and terminate principal-owned process groups before reclamation, while preserving peer runtimes.
• Reclaim KV before removing the profile needed by the production quota resolver, retaining the retirement fence throughout teardown.
• Tear down through refactor(kernel): AgentDelete always reclaims a deleted principal's footprint (#1217) #1383's reclaiming AgentDelete; --keep remains an explicit debugging escape hatch.

Verification

• cargo fmt --all -- --check
• cargo test -p astrid-kernel --lib -- --quiet: 309 passed
• cargo test -p astrid-capabilities --lib -- --quiet: 78 passed
• Native deletion and restricted derive regressions
• Retirement drain, late-admission, KV/FS/secret denial, and secret-read barrier regressions
• Process-group descendant cancellation with peer continuity
• Strict non-default profile loading and registration-versus-unload serialization
• Wasm portability script
• Exact CI clippy package surface with all targets/features and -D warnings
• git diff --check

The live spawn-run-teardown proof passed against a fresh restricted principal derived from gemma-code: the real React and OpenAI-compatible provider capsule set warmed, the provider returned exactly PR1384_LIVE_OK, teardown succeeded, and the principal disappeared from agent list. Its profile, home, key, secrets, and isolated test homes were absent afterward.

AI / Tool Assistance

Assisted-by: OpenAI Codex: GPT-5

Codex helped reconstruct and adversarially review the patch on current code, remove capability-escalation paths, preserve public Rust API compatibility, integrate fleet-ownership-safe rollback, harden retirement and teardown ordering, add focused regressions, and execute the live provider-backed spawn-run-teardown proof. I reviewed the final changes, risks, and validation and created each GPG-signed, DCO-compliant commit.

Checklist

• Linked to an issue
• CHANGELOG.md updated
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested any meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.

[jvsteiner]

@joshuajbouw ready for review — agent spawn: atomic locked-down throwaway session composing shipped primitives. Second of two for #1217; stacked on #1383 (diff includes it until that merges).

[joshuajbouw]

Review outcome: not ready to advance; please keep this as draft or rework it. The “locked-down” guarantee is not enforced as an invariant because callers can supply --group; the live run/warm-up path is not demonstrated; and teardown depends on best-effort purge. Please land or resolve the purge design first, constrain the security surface, provide live end-to-end evidence, and fix the required PR template/changelog. I have not approved the currently gated workflows.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.