feat: add managed agent integration lifecycle

[iperev]

Summary

• Add explicit managed install, update, removal and recovery for repository-local Codex and Claude integrations. One bounded bootstrap delegates to the current CLI; it does not duplicate repository policy or execute witnesses.
• Extend the existing repository transaction owner with explicit desired absence, confined deletion, rollback, recovery and bound terminal replay. Preserve local edits and adjacent instructions; do not add a second installer journal or a force mode.
• Publish the reviewed breaking edge from 0.10.1 to 0.11.0, including exact command contracts, native-source identities, requirement bindings and independent witness inventories.

Boundaries

The per-tool baseline recognizes a cooperative pair of exact prior bytes. It
does not authenticate historical origin or permit overwriting local edits.
New generation-2 terminal receipts bind the desired-state identity; the old
binary must reject them without mutation even after the transaction completes.
Legacy receipts remain readable historical evidence but cannot authorize an
apply replay. Recovery preserves the original terminal outcome.

Operational observation failures remain operation errors, not semantic recovery
packets. Cancellation, rollback, cleanup and durability outcomes retain their
native meaning through both JSON/text CLI projections and exit codes.

Verification

The final committed candidate 4e8d227ff97ca28ced33da6cc638c0f45232306e
passed npm run check with the pinned npm 12.0.2 toolchain, including the full
Go suite, static checks, 93 browser tests across Chromium/Firefox/WebKit,
package/wheel verification, command-oracle/coverage and release closeout.
Committed-range git diff --check passed and the worktree remained clean.
Exact-head GitHub checks are a separate merge prerequisite, not yet claimed.

Additional evidence includes transaction/integration/adoption race tests on
the unchanged runtime, nine causally isolated semantic mutants, the actual
published predecessor across six pending/terminal recovery cases, and isolated
native Codex/Claude present/absent/altered-skill controls. Each native-host
record retains the source and binary identity actually executed. The final
test-only repair independently kills the update-byte-guard mutant for both
tools and admits the real CLI positive control.

Independent reviews cover owner boundaries, state transitions, CLI/error
projection, proof inventories and oracle independence. No-finding results are
bounded review observations, not a claim of universal defect freedom.

Non-Claims

This pull request does not establish publication, consumer rollout, production
readiness, authenticated baseline ownership, revocation of an already loaded
skill, or support for arbitrary native agent hosts. Browser redesign and source
codec selection remain separate roadmap phases. Design and implementation
working documents remain outside the repository.