refactor(agents): replace avatar-clear boolean with AvatarState tri-state enum

[tellaho]

Overview

Category: improvement
User Impact: A deliberately cleared agent avatar now stays cleared instead of being silently resurrected on the next sync.

Problem: ManagedAgentRecord.avatar_url: Option<String> overloaded None to mean two contradictory things — "legacy record, backfill a default" and "user deliberately cleared it." That ambiguity is the bug: a user-cleared avatar gets backfilled (resurrected) on the next reconcile. On top of that, main had no avatar-clear path at all — UpdateManagedAgentRequest exposed no avatar_url field, so a clear couldn't even be expressed.

Solution: Replace Option<String> with a single AvatarState tri-state enum on ManagedAgentRecord:

• Set(url) — explicit url, use as-is, never backfill
• Cleared — user deliberately cleared, stays empty, never backfill
• Unmigrated — legacy/unknown, eligible for backfill once, then becomes Set/Cleared

The three states are mutually exclusive and type-enforced, so every read site must handle all three and no None is left to overload. Custom serde keeps this zero data migration: legacy bare-string maps to Set, null/absent maps to Unmigrated (preserving today's backfill-once semantics byte-stably), and Cleared serializes to a self-describing {"cleared":true} sentinel that no legacy record can ever produce. Cleared is reachable only through an explicit user clear via the update path (Option<Option<String>>, matching the existing model field convention) — an invariant covered by tests. Avatar updates now sync to relay immediately, consistent with name changes.

Scope note — backend-only. This is the avatar-clear state model plus the backend clear plumbing. Wiring the TS UI to actually send a clear (UpdateManagedAgentInput.avatarUrl) is a separate UX follow-up and is intentionally not in this PR. The app-avatar:<id> symbolic-ref scheme is independent and untouched.

File changes

desktop/src-tauri/src/managed_agents/types.rs
Defines the AvatarState enum + custom serde (string to Set, null/absent to Unmigrated, {"cleared":true} to/from Cleared); swaps the record field; adds the direct round-trip + sentinel tests. File-size override bumped for the added tests.

desktop/src-tauri/src/commands/agents.rs
Collapses the reconcile path into a three-arm AvatarState match (Set use-as-is / Cleared no-backfill / Unmigrated backfill-then-persist-as-Set).

desktop/src-tauri/src/commands/agent_models.rs
Adds the Option<Option<String>> avatar update field (absent = don't touch, null = Cleared, Some(url) = Set).

desktop/src-tauri/src/commands/agents_tests.rs
Adds the creation invariant test: no creation/constructor path can yield Cleared.

desktop/src-tauri/src/managed_agents/{nest,relay_mesh,runtime/tests,team_repair}.rs
Updates the non-user-facing ManagedAgentRecord fixtures/constructors from avatar_url: None to AvatarState::Unmigrated.

desktop/scripts/check-file-sizes.mjs
Narrowly-scoped types.rs size override for the tri-state code + tests.

Reproduction Steps

1. Check out tho/agent-avatar-clear-tristate and run just desktop-tauri-test — 584 lib tests pass (6 new).
2. Inspect AvatarState in managed_agents/types.rs and the three-arm match in commands/agents.rs.
3. Confirm the round-trip tests in types.rs prove all four on-disk cases map correctly and the Cleared to {"cleared":true} to Cleared sentinel holds.

Validation

584 lib tests pass (0 fail), clippy -D warnings clean, fmt no churn. Pre-commit/pre-push hooks green except the known dart-missing mobile hook (no Dart touched).