feat(desktop): harness-agnostic config bridge

[wpfleger96]

Adds a harness-agnostic config bridge that reads agent configuration from all available sources and exposes it to the frontend with full provenance — where each value came from and how it can be written back.

Agent config was fragmented across four uncoordinated mechanisms with no single surface to see what a running agent would actually use. The silent failure mode was concrete: Wes's goose personas failed because active_provider in ~/.config/goose/config.yaml was invisible to Sprout and overrode our injected model. The bridge surfaces that ambient config, establishes a clear precedence order, and routes writes to the cheapest live mechanism.

• New config_bridge module with per-runtime config file readers: YAML for goose (~/.config/goose/config.yaml), JSON for Claude Code (~/.claude/settings.json + ~/.claude.json), TOML for Codex (~/.codex/config.toml). 25 unit tests covering all formats, malformed files, and missing files.
• Four-tier precedence: Sprout-explicit > ACP native (reserved for goose post goose#9197) > ACP configOptions from session/new > env vars > config file on disk. Pre-spawn surfaces tier 2 only; post-spawn adds ACP tiers.
• session_config_captured observer event emitted after session/new; put_agent_session_config Tauri command populates SessionConfigCache in AppState. parse_models handles both the object shape ({currentModelId, availableModels}) and legacy array shape from session/new.
• get_agent_config_surface and write_agent_config_field Tauri commands. Write mechanism is chosen per runtime and field: session/set_config_option (live, no restart) before env-var respawn. Single lock scope on the write path closes a TOCTOU race.
• AgentConfigPanel component with origin badges (Sprout/ACP/ConfigFile/Env), collapsible advanced section, and sources footer showing all four tier statuses. Override/strikethrough rendering shows superseded config values inline — the overridden value appears crossed out next to the effective value, with both origin badges visible for at-a-glance provenance. Read-only fields display an info icon with tooltip rather than a lock icon.
• ModelPicker shows provenance label when config surface data is available post-spawn (best-effort, non-blocking).
• Playwright E2E screenshot spec covering 7 scenarios (goose, claude-code, codex, pre-spawn, overrides, advanced section, sources footer) for visual review.
• Fixes codex.provider_locked to false — Codex supports [model_providers.<id>] custom provider tables. Fixes serde enum tagging on ConfigWriteMechanism, ConfigFieldType, and WriteConfigTarget to use #[serde(tag = "type")] matching the TypeScript discriminated union shapes (default external tagging made all write operations and TS type guards silently broken).

Stack: #794 → this PR

[wpfleger96]

Config Bridge — AgentConfigPanel Screenshots (v4)

Updated screenshots with inline override rendering: overridden values appear with strikethrough next to the effective value, and overridden origin badges appear next to the effective badge.

1. Goose — Full Config Panel

Mixed-origin badges (Sprout/ACP/ConfigFile/Env), model/provider/mode fields with provenance tracking. Info icon on read-only fields with hover tooltip. Override value inline with strikethrough.

2. Claude Code — ACP Config Options

ACP-sourced values with green badges, demonstrating the "one surface, multiple runtimes" approach.

3. Pre-Spawn State

Dimmed ACP fields showing "Available after agent starts" — config surface before runtime is active.

4. Override Visibility

Effective value shown with overridden default crossed out inline, plus both origin badges side by side.

5. Advanced Section Expanded

Collapsible advanced section with runtime-specific extra fields (extensions, output style, etc.).

6. Sources Footer

Four-tier status indicators showing which config sources are active.

7. Codex — Dual-Mode Display

Codex's unique dual-axis mode (approval_policy × sandbox_mode).