fix(agents): make SQL store signatures content-sensitive

[AoHanBei]

Fixes #4706

Why

SqlAgentStore.signature() used max(updated_at) plus the row count as its cache invalidation token.

When an agent update reused the current maximum timestamp, neither part of that token changed even though the stored agent configuration had changed. The GitHub agent registry could therefore continue using stale webhook routing until another mutation or process restart invalidated the cache.

What changed

• Replaced the SQL agent store's timestamp-based signature with a deterministic SHA-256 digest of the ordered stored agent contents.
• Included each agent's owner, name, config, and soul in the digest.
• Added a deterministic regression test that updates an agent while reusing its existing timestamp.
• Updated the agent-store and GitHub registry cache-invalidation documentation.

This requires no database migration and does not change the public API or the file-backed agent store.

Surface area

• Frontend UI — page / component / setting / interaction under frontend/
• Backend API — endpoint / SSE event / request-response shape under backend/app
• Agents / LangGraph — agent node, graph wiring, langgraph.json, or prompt change
• Sandbox — docker/ or sandboxed execution
• Skills — change under skills/
• Dependencies — new/upgraded entry in backend/pyproject.toml or frontend/package.json (say what it buys us)
• Default behavior change — changes existing behavior without the user opting in (default model, default setting, data shape)
• Docs / tests / CI only — no runtime behavior change

Screenshots / Recording

Not applicable — this is a backend cache-invalidation fix with no UI changes.

Bug fix verification

• Test path that reproduces the bug: backend/tests/test_agent_store_sql.py::test_signature_changes_when_update_reuses_timestamp
• Did it go red on main and green on this branch? Yes
  • Before the fix: the stored description changed, but the signature remained unchanged.
  • After the fix: both signature regression tests pass.

Validation

• uv run pytest tests/test_agent_store_sql.py tests/test_github_registry.py -q --tb=short -p no:cacheprovider — 32 passed
• uv run ruff check packages/harness/deerflow/persistence/agents/sql.py packages/harness/deerflow/persistence/agents/base.py app/gateway/github/registry.py tests/test_agent_store_sql.py — passed
• uv run ruff format --check packages/harness/deerflow/persistence/agents/sql.py packages/harness/deerflow/persistence/agents/base.py app/gateway/github/registry.py tests/test_agent_store_sql.py — 4 files already formatted

AI assistance

Tool(s) used: Codex

How you used it: Codex helped investigate the cache-invalidation bug, implement the deterministic regression test and content-sensitive signature, update the relevant documentation, and review the final diff. I ran and verified the reported tests and checks locally.

• I've read and understand every line of this change and take responsibility for it — it's not unreviewed AI output.

[CLAassistant]

All committers have signed the CLA.