feat(runtime-host): add ACP connection ownership and sign-in state

[Sun-GLiang]

Summary

• Add Antigravity task execution on top of the existing ACP connection and authentication foundation. ACP tasks use an external executor identity without requiring a native LLM connection.
• Keep the ACP backend process-local while a task is live, bridge permission requests into the transcript, preserve ordered assistant/tool projections, and propagate durable stop reasons.
• Persist completed transcripts while exposing a history-only state after the Desktop app restarts or the external Agent disconnects.
• Replace the Composer's single-column target menu with a responsive executor/model picker. Long localized labels, including 配置外部 Agent, remain fully visible without horizontal scrolling.
• Preserve ACP connection, initialization, session/new, prompt, transport, and provider-execution failures as explicit terminal events with stage-specific reasons plus bounded, secret-redacted diagnostics.
• Keep Antigravity's localhost harness out of inherited system proxies by extending both NO_PROXY spellings with localhost, 127.0.0.1, and ::1 without discarding the user's existing bypass list.
• Cover admission, initialization, session/new, prompting, permission settlement, cancellation races, attachment rejection, proxy inheritance, typed failure finalization, and AppShell architecture boundaries.

Refs #5103

Verification

Baseline validation completed at 2a49069dd:

Check	Result
Workspace typecheck, lint, formatting, git diff --check	Passed
Renderer architecture	103/103 passed; architecture ledger unchanged
Core	829/829 passed
Runtime Host	1,922 passed, 12 skipped
Runtime	3,431 passed, 13 skipped; 2 pre-existing Zod recursive-identity failures remain in the current dependency environment
Desktop	2,550/2,550 passed
UI	419/419 passed
CLI	934 passed, 3 skipped
Eval	Node and Python suites passed

Follow-up validation at e79f98799: the Runtime Host build passed; the 3 new initialize/session_new/prompt diagnostic regressions passed; the related ACP suites passed 29/29; Biome and git diff --check passed.

Follow-up validation at 6d8cd7cdf:

• Full workspace build, Biome on all 7 changed files, and git diff --check passed.
• ACP Runtime Host suites passed 30/30; the Runtime terminal-ledger suite passed 44/44; targeted AgentRun regression tests passed 3/3.
• The full Runtime suite reported 3,431 passed and 13 skipped, with the same 2 pre-existing Zod recursive-identity failures noted above.
• The full Runtime Host suite reported 1,926 passed and 12 skipped. Its 6 failures reproduce in the untouched client-capability-session-scope suite and are unrelated to ACP; every affected ACP suite is green.

Desktop acceptance

Re-ran the production renderer in Electron with official Antigravity ACP 1.1.1 and the normal Maka Dev profile. The final verification launch did not inject HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY into the Desktop process. The macOS system proxy remained enabled, including its loopback SOCKS endpoint; the ACP child inherited external routing while bypassing the proxy for its own localhost harness.

• The target picker switched between Maka and Antigravity correctly. At the acceptance window size, the menu reported clientWidth === scrollWidth === 808; horizontal overflow was hidden and all localized labels were visible.
• A real ACP permission request displayed the requested pwd command, the Antigravity · ACP requester, and Allow/Deny actions.
• After a one-time Allow, pwd and client_view_file appeared in arrival order and the final answer contained the expected working directory and the first line of README.md.
• Stopping a live sleep 30 command produced an interrupted tool/turn state instead of waiting for natural completion.
• After restarting the same Desktop profile, the successful task's prompt, tool activity, and answer remained readable. The Composer showed the localized history-only notice and offered a new-task action.
• ACP attachment send-blocking remains covered by the passing Desktop/UI automation. A native file-picker screenshot is intentionally omitted because it would not add evidence beyond the automated rejection coverage.
• The original system-SOCKS reproduction reached session/new and failed because official ACP 1.1.1 does not bundle python-socks. After the local bypass fix, the same no-manual-proxy launch completed a real prompt in 9 seconds and persisted completed / end_turn.
• An intentionally unverified-login run displayed the authentication diagnostic and persisted acp_setup_authentication_failed, rather than replacing it with missing_terminal_event. After restoring cached Google authentication, a final live prompt again completed in 9 seconds with completed / end_turn.
• Provider text beginning with Agent execution error: now produces the structured acp_agent_execution_failed event before terminal completion, so the renderer can show diagnostic details instead of “无可用诊断详情”; this boundary is covered by the new backend regression test.

UI acceptance screenshots

Executor/model picker	ACP permission request
Successful ordered tool result	Stop control while command is running
Interrupted turn	History-only state after restart
Typed authentication diagnostic	Final no-manual-proxy verification

The screenshots above are GitHub user attachments referenced only from this PR description; no image file is tracked by the branch.

See the sanitized verification record for the detailed validation history and evidence boundaries.

Review focus

PR1 #5164 was squash-merged as 41da161d6d2aa53c82b2ccf261e519cf09a09b7d; this PR is based on that merge commit and advances the protocol epoch to 147 for ACP execution identity.

Please focus review on executor identity and strict decoding, process ownership, live/history-only availability, transcript preservation without modelId, file containment, permission settlement, cancellation races, mixed tool-result ordering, local proxy bypass, typed ACP failure finalization, and the Composer executor/model state machine.

The PR remains in Draft while human review and GitHub CI are pending. The current branch also requires conflict resolution against the latest target branch before CI can run.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed implementation, tests, evidence documentation, Desktop acceptance, and PR preparation. Independent human review remains pending.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No