docs(research): HPC setup-agent feasibility study

[Hongjiseung-ROK]

Summary

• add docs/research/setup_agent_feasibility.md, a research-only feasibility study for an initial HPC setup agent
• document verified architectural findings from the current settings and agent subsystems, separating code-verified facts from projected design
• cover SSH transport tradeoffs, scheduler probing plans, Plan/Critic integration, failure modes, and web research references

Scope notes

• Pure research task; no source code changes beyond the new report file
• bin/plan.md was intentionally not used because this task explicitly states it does not exist and should be skipped
• No changes to chemsmart/**, tests/**, or examples/**

Validation

• No tests run (documentation/research-only change)
• Verified report length target locally: 1187 lines

Deliverable

• Research report: docs/research/setup_agent_feasibility.md

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive feasibility study for an HPC initial-setup agent, detailing architectural requirements, proposed tool schemas, and SSH security strategies. The review feedback identifies several improvement opportunities, including refactoring the Executable loader to support in-memory validation, implementing filename sanitization to prevent path traversal vulnerabilities, and noting Slurm version constraints for JSON output support.

[gemini-code-assist]

The proposed validation tool aims to verify compatibility with Executable.from_servername(...). However, as noted in Section 2, Point H, this method is currently hardcoded to read from user_settings.user_server_dir. To avoid side effects (like writing temporary files to the user's config directory) during validation, the feasibility study should consider recommending a refactor of the Executable loader to support dictionary-based instantiation, which would allow the validation tool to operate purely in memory.

[gemini-code-assist]

The write_server_yaml tool takes a server_name string. Since this is used to construct a file path under ~/.chemsmart/server, the feasibility study should explicitly mention the need for filename sanitization to prevent path traversal attacks (e.g., if an attacker-controlled planner provides a name like ../../.bashrc).

[gemini-code-assist]

The report mentions sinfo --json as the best first probe for SLURM. It would be beneficial to note that JSON output was introduced in Slurm 20.11. Many older HPC clusters still in production (e.g., running CentOS 7 with older Slurm versions) will not support this flag, making the text-based fallback (scontrol --oneliner) the primary path in those environments.