refactor(run): register managed runs per agent

[Stephen Belanger (Qard)]

Summary

Based on main now that #137 has merged.

run_traced matched on RunSource throughout:

• rejecting Codex's --dangerously-bypass-hook-trust and non-interactive Cursor runs
• choosing each agent's executable
• creating Cursor's invocation-local plugin and discovery hooks
• setting OpenCode's inline config

Those branches now live in ManagedRun impls in managed_run/<agent>.rs. The Codex, Claude Code, Cursor, OpenCode and Pi agent types register them next to their setup adapters. Grok and Antigravity don't support managed runs, so they don't register one.

pub(crate) trait ManagedRun: Agent {
    fn executable(&self) -> (&'static str, &'static str);                // (env override, default)
    fn check(&self, agent_args: &[OsString], terminal: Terminal) -> anyhow::Result<()>;
    fn inject(&self, hook_command: &RunHookCommand, managed_run_id: &str) -> anyhow::Result<Injection>;
}
pub(crate) struct Injection {
    pub args: Vec<OsString>,
    pub env: Vec<(&'static str, String)>,
    pub guards: Vec<Box<dyn Send>>,   // e.g. Cursor's temp plugin dir and discovery hooks
}

run_traced looks up the agent, then runs the shared steps itself:

• the destination check
• daemon isolation
• the launch
• the Ctrl-C handling
• the flush and cleanup

It holds the agent's guards until the agent exits. A new test checks that every RunSource variant resolves to a registered managed run.

Behaviour

Unchanged, apart from two orderings:

• Check order. Agent-specific checks now run before the destination check. A Codex run that has both a missing destination and --dangerously-bypass-hook-trust now reports the flag first. Cursor's terminal check already ran first.
• Cursor hook install. Cursor's discovery hooks are installed during inject, which is slightly earlier than before (before the isolated daemon directory is created, rather than just before spawn). They are still removed when the run exits.

Testing

• cargo clippy --all-features --all-targets -D warnings is clean.
• cargo test --all-features --no-fail-fast: everything passes except trace_runtime::tests::doctor_reports_a_daemon_that_{cannot_authenticate_the_route,resolves_other_credentials}, which fail the same way on main in my local environment.
• Managed-run tests moved beside each agent's impl and now call inject directly. One new registry test.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T12:37:10.848320Z	40a95f7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.