fix: contain authentication failures and reconnect resource use

[yuezengwu]

Summary

A terminal authentication failure during daemon startup could exit the process and let the supervisor restart it, repeating refresh requests and WebSocket handshakes. Connections now pause until credentials recover. CLI recovery compares current credentials with the failed attempt, including a login saved before an old rejection arrives. Standalone AgentRuntime exposes a pause callback, pause status, and resumeAfterCredentialsChange() so its host can recover the same runtime; synchronous and asynchronous observer failures cannot interrupt cleanup.

Successful registration is the single boundary for starting or resuming capability work. The CLI no longer derives readiness from welcome frames or separately reopens the gate after agent startup. Attempt credentials explicitly distinguish the transmitted access token from a pre-provider snapshot; snapshots ignore file formatting and unrelated fields. Existing onReconnect consumers remain supported.

Refresh callers share identical credential snapshots, retain a bounded terminal-401 latch, and discard obsolete outcomes. Server WebSocket authentication runs one attempt per connection and ignores completions after close or timeout. Log rendering is separated from sink admission and loss accounting, preserving the 64 KiB record cap and 256 KiB destination queue cap. Only admitted normal records enter the trace bridge. The logging refactor is a separate commit for review and rollback.

Validation

• pnpm check and pnpm typecheck passed for 986b24334fbd7378594670931e1ce1a2277d5518.
• With database environment variables removed, pnpm test --concurrency=1 passed: 12,521 passed, 8 existing conditional skips. Source hashes remained unchanged through validation and match the committed files. Unchanged build/test tasks used content caches.
• The default parallel run failed three unchanged client-switch tests because a concurrently spawned synthetic Grok provider process appeared between macOS process snapshots. The complete serialized run passed, including all 22 tests in that file; no process-drain logic or assertions were weakened. The failed run is retained in local evidence.
• New standalone-runtime loopback tests: 4/4 passed. CLI recovery tests additionally verify that formatting, field ordering, and unrelated credential metadata do not reopen authentication work.
• Author adversarial review of the integrated changes found and covered asynchronous host callback rejection handling. No remaining blocking finding was identified in this review; this is not independent approval.
• GitHub checks passed on this head: 17 successful, 2 skipped. CI run and CodeQL passed without a failed-job rerun; prior-head CI results are not reused.

Regression coverage includes initial handshake and token-provider rejection, explicit standalone recovery and terminal stop, synchronous/asynchronous host observer failures, early login recovery, unchanged and self-rotated rejected credentials, metadata-only credential writes, registration-gated capability work, obsolete refresh outcomes, duplicate auth frames, retired connection completions/timers, and failed/stalled logging sinks. Existing logging-bound assertions were preserved.

Scope and remaining acceptance

• No database, wire protocol, command syntax, configuration, version, release workflow, or runtime dependency changes. The CLI adds the already-used @types/ws@8.18.1 only for loopback regression tests.
• Existing QA cases ws-client-auth-frame-enforcement and authenticated-ws-inbox-delivery match the affected release boundary; case disposition: no-change. Deployment, owner login, real registration, and business WebSocket delivery remain release acceptance work.
• Logging limits apply after pino serialization and do not cap healthy-output I/O volume. Dropped records also lose their log-to-span bridge; asynchronous sink failures may undercount lost queued records. Single-connection auth containment is not an instance-wide load guarantee.
• This PR has not been merged or deployed and does not establish the cause of the earlier host I/O incident.