Declare agent-host Session views in the Runtime–Harness protocol

[SaladDay]

Lane L5p of the agent-outside-sandbox workstream. It is a Runtime–Harness protocol change: a Harness declares how it runs in an agent-host Session view. Its loop runs on the agent host, its file and process operations go to the sandbox, and its model and MCP traffic goes through the Session gateway. Every adapter declares View: nil in this PR; the adapter lanes fill it in.

Protocol (apps/daemon/internal/agent/harness.go, registry.go)

• Runtime.View *View:
  • the closure mounts, overlays and masks;
  • the local executables, shims and shim paths;
  • forwarded environment;
  • the proxy mode (ViewProxyEnv or ViewProxyNone, with an invalid zero value);
  • a ViewExecutorFactory that receives a ViewSession (home, proxy and Launch).
• View.Validate() checks a declaration without touching the host, and an invalid declaration gives ErrInvalidView.
• Registry.RegisterView validates the view and wraps its factory so Prepare runs first, like the other factories.
• Registry.ResolveView returns a copy. A kind without a view gives ErrUnsupportedOperation; an unknown kind gives ErrUnsupportedKind.
• TestPublicHarnessContractDeclarations requires every declaration to state View explicitly.

Supporting changes

• clirunner:
  • Handle, HandleOptions and FromHandle provide a handle-backed process. Cancel sends TERM, then closes the handle after KillTimeout.
  • Process.ExitCode() is the exit-status accessor, so Codex no longer reads exec.Cmd.
• sessionview:
  • Spec.StagingParent is required, an existing absolute directory, with no temp-dir fallback.
  • PrivateRoot and ShimDir are exported.
• harness-onboarding.md:
  • A registration-order row for RegisterView.
  • A "Run in an agent-host view" section that links to the credential gateway rule.

Checks

• Tests on agent, clirunner, codex (race), claudesdk, mcode and sessionview.
• The privileged sessionview tests in a container.
• Vet and gofmt; linux, darwin and windows builds.

Blind review fixes

Two blind review rounds; their fixes are in the three follow-up commits.

• Credential handoff:
  • The agent host resolves MCP once, from the request and LocalEnvironment.MCP, and passes it in ViewSession.MCP: HTTP bindings at gateway URLs with no credentials.
  • The view request carries no other MCP source.
  • Declaration.ConnectionOptions marks native options that carry connections (Codex and MiniMax: mcp_servers, env). The view rejects them with ErrViewHandoff.
  • Before the factory runs, the prepared model provider must be a loopback gateway URL with modelprovider.Placeholder.
• Validation: ForwardEnv rejects proxy variables and names the view owns (HOME, PATH, TMPDIR, LANG, LD_LIBRARY_PATH).
• Layout: the view layout is defined once in harness.go (ViewPrivateRoot, ViewShimName, ViewHomeName, ViewRunName, ViewReserved). sessionview imports it, and agent no longer imports sessionview.
• Handle:
  • Cancelling an exited process does nothing, and a cancel racing a successful exit leaves it a success.
  • Wait closes stdin, stdout and stderr once.
  • An interrupted exit 0 returns the context error, as exec.CommandContext does.
• Descendant grace: View.Signal reaches every process in the view. When the leader exits, remaining processes get one TERM, never a second one, and the remaining grace.