feat(agent): checkpoint remote execution foundations

[AnthonyRonning]

Summary

This draft checkpoints the existing remote Agent foundation in a reviewable, recoverable branch before the Maple product-integration sprint begins.

It adds the bounded/authenticated remote transport and live-event substrate, target-scoped paged task/history runtime, and the fail-closed portable history surface. It also reconciles those foundations with current Maple Agent behavior from master, including prompt history, focus handling, and the Maple-owned mid-run queue.

Deliberate boundaries

• This is inactive foundation work, not an end-to-end remote Maple feature.
• Maple does not yet install the real pairing provider, secure credential flow, host listener, or controller connection at normal startup.
• No pairing/settings UI or local-vs-remote project selector is included yet.
• Desktop queue state remains local-only. Remote selection uses an explicit empty queue snapshot until the remote protocol deliberately supports queue state; queue events are rejected from remote live projection.
• The browser-only QA fixture and its package/config hooks are excluded. Validation is intended to move to actual Maple desktop instances in the next phase.
• No dev or production environment was touched.

Dependencies

Goose and goose-providers are temporarily pinned to the immutable OpenSecretCloud/goose commit 7c989fd13213e1c31d77d2d4bf298660ec5fdca0. This is a temporary fork pin pending upstreaming or a released dependency.

The unpublished local OpenSecret SDK is intentionally not introduced into this PR. The next local-only integration phase can layer its workspace path and regenerated lockfile on a separate local QA branch without making the PR non-reproducible.

Commit structure

1. 38a4802 - remote transport and history foundations
2. 41af686 - target-scoped paged history runtime
3. 616d790 - fail-closed portable history surface
4. 05c35bd - non-rewriting reconciliation with current master

Validation

• ./scripts/ci/frontend.sh: 904 passed, 0 failed; formatting, lint, and typecheck passed (13 existing unrelated lint warnings)
• ./scripts/ci/rust.sh: 667 passed, 0 failed, 3 intentionally ignored
• just rust-lint: passed; only warnings from the existing patched tao dependency
• Pre-commit production web build and full frontend/Rust suites: passed
• Focused local queue projection and runtime-service tests: passed
• git diff checks and conflict-marker scan: clean

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	05c35bd
Status:	✅  Deploy successful!
Preview URL:	https://75dac9c9.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-remote-agent-map.maple-ca8.pages.dev

View logs