feat(providers): adopt runtime capability parity

[astyfx]

Summary

Adopt the supported H1 2026 Claude and Codex runtime capabilities behind version-aware provider descriptors, with safe fallbacks for older or unknown executables.

Changes

Features

• providers: add runtime capability discovery and fail-closed UI/runtime gating
• claude: upgrade the exact Agent SDK pin to 0.3.197 and add credential guards, file rewind, permission-denial events, and hook activity
• codex: add app-tool writes approval, indexed search fallback, turn-boundary forks, and read-only hook inventory
• chat: persist provider history boundaries and expose capability-aware fork and rewind controls

Refactors / Chores

• providers: keep normalized events, preload, IPC schemas, host protocol, and adapters synchronized
• docs: add the runtime adoption plan and a Claude SDK upgrade checklist; refresh the Codex checklist and runtime baseline

Test Evidence

• bun run test:ci — passed 339 isolated test files plus web and desktop builds
• targeted provider, IPC, replay, thread-action, and theme tests — 339 passed
• post-rebase thread-action and Claude regression tests — 144 passed

Notes

• Claude auto-mode classifier settings, Codex permission profiles, multi-agent policy, rollout budgets, and conversation rewind remain intentionally deferred.
• Risk is limited by runtime-version capability checks and downgrade behavior; rollback is a revert of this commit and the SDK lockfile change.

[upwind-code-us]

Upwind Code Scan - ✅ Proceed with Deployment

0 newly introduced vulnerabilities · 0 resolved · 0 total in this PR vs main

View full analysis in Upwind Console

Scan completed in 16s

Scan history (2 scans)

Commit	Scanned at	New	Resolved	Net
a2f0d77	2026-07-31 16:44 UTC	—	—	—
a2f0d77 <	2026-07-31 16:44 UTC	0	0	0

Last scanned: a2f0d77 · 2026-07-31 16:44 UTC

[heath-s]

Approved