feature: IBM Bob support — detection, settings, parsed events, token and cost accounting

[huang195]

Feature Description

Bob support on the agent integration contract. Bob is our internal coding agent, and this is
an internal release: Bob is an agent our own team runs, so observability for it is much of
what the release is for.

Proposed Solution

• Confirm Bob's wire format and where it stores settings — unlike the other agents there is
  no public reference, so capture this in the issue before implementing
• Detect an installed Bob and locate its settings
• Patch it to use localhost:47600 and the Cortex CA; ask before editing, support revert
• Traffic parsed into typed events, not merely proxied
• Token counts correct for its wire format
  • and cost correct
• Metrics aggregate alongside other agents
• A tool inventory, or state explicitly that tool pruning is unsupported
• Setup documented; verified depth stated

Additional Context

Part of the Cortex v0.9.0 release. Depends on the agent integration contract.

[esnible]

A lot of this work has been done -- We now see token counts and usage graphs when doing abctl exec -- bob.

Do we want an abctl bob-code in addition to abctl exec?
If we are in the business of creating config-rewriters for many harnesses, should we move them into a subcommand, e.g. abctl configure claude-code, abctl configure bob-code, etc?

[esnible]

Note that there are two different products that are both called "Bob":

IBM Bob (typically /Applications/IBM Bob.app, a full agentic IDE — a standalone desktop application.
Bob Shell (typically /opt/homebrew/bin/bob), the terminal/CLI counterpart

"IBM Bob" has proxy settings, e.g. in ~/Library/Application Support/IBM Bob/User/settings.json, but they affect the whole IDE, not just using Bob. It also respects env vars such as HTTP_PROXY
Bob Shell does not have a proxy settings file. It respects env vars such as HTTP_PROXY

[esnible]

For IBM Bob, the VSCode based IDE, we need to define the HTTP_PROXY and HTTPS_PROXY before launching "/Applications/IBM Bob.app/Contents/MacOS/IBM Bob". This gives us CONNECT events, but no TLS termination and no token counts no matter if we also export NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, etc

To see the actual traffic in authbridge, on the Mac, we must add the AuthBridge cert to the keychain using sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /Users/snible/.cortex/ca/bundle.crt

If we don't want to use env vars, then $HOME/Library/Application Support/IBM Bob/User/settings.json defines

    "http.proxy": "http://127.0.0.1:47600"