Remove Dispatcher.Options and legacy daemon Sessions

[SaladDay]

Dispatcher.Options was a test-only second source of native adapter options for Sessions without a frozen model provider. Production never set it. This deletes it, along with the legacy daemon Session path it served. Production never writes a daemon Session configuration.

Deleted

• Dispatcher.Options and its branch in execution/request.go.
• Snapshot.Daemon, DaemonConfig, the daemon half of resolveExecutionEnvironment, and the hasDaemon parameter of engine.Profile.ValidateConfiguration, ValidateTools and ValidateMCPOrigins.
• Run accepts only environment: none Sessions. The one predicate environmentNone serves Run, input admission and the capability check.

Tests move onto the declared configuration path

• Native tests serve their synthetic model over HTTPS. It is signed by a test CA that the daemon process trusts through CODEX_CA_CERTIFICATE; the daemon and adapter code are unchanged.
• Each test freezes that model as the deployment default model provider, the way a real client would.
• The real-model opt-in options file is strict JSON: {model, model_provider} (documented in harness-onboarding.md).
• The adversarial enable_features / model_verbosity / web_search inputs are gone, because Core can no longer send them. The precedence rule is still covered by the daemon codex tests TestExecutionControlsOverrideWithoutMutatingNativeOptions and TestDisableSubagentsOverridesNativeFeaturePreferences.
• TestExecutionRejectsLegacyDaemonBeforeClaim becomes TestExecutionRejectsRuntimeMissingCapabilityBeforeClaim. Each subtest now fails on its own capability, and there are new preparation and environment_none cases.

Behaviour changes

• A non-none Session reaching Run gets ErrInvalidInput.
• Core never sets WorkDir. A daemon key in a Session configuration has no effect.
• Model options come only from the frozen model execution.

Checks

• go build ./... passes.
• go vet passes on execution, engine and api.
• go test -p 1 on engine, execution, cmd, api and store against PostgreSQL, with the native daemon and the pinned SDK: 2854 passed, 0 failed, 9 skipped. The skips are opt-in real-model and operator-binary tests. 452 DB-backed tests ran.
• check-names.py and the markdown link test pass.

WorkDir moves off the Core–Runtime wire in a follow-up Runtime–Harness PR.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}