Canonicalize agent execution connections and delivery ownership (AXI-115)

[Codename-11]

What changed

• Added durable AgentConnection identities for managed runtimes, MCP clients, webhooks, and on-demand work, with connection provenance on runs, events, and delivery sessions.
• Made lifecycle detection transport-aware: silent MCP clients become quiet/unconfirmed without false stall or automatic redispatch; managed runtimes retain heartbeat recovery.
• Enforced one active primary delivery connection with explicit MCP join/handoff, conflict action requests, and merge-time reconciliation of lingering execute runs.
• Expanded Agent Profile, Access, Agent Policy, Command Center, and issue Delivery surfaces with type, confidence, last-seen evidence, participants, mismatch warnings, and audited reconciliation.
• Added a conservative Prisma migration, integration coverage, documentation, and refreshed Agent Studio audit captures.

Why

AXI-113 exposed the underlying model gap: delivery ownership could name a profile while the actual work was performed by a different MCP connection, and runtime heartbeat assumptions made MCP work look stalled. This makes the connection—not only the profile—the canonical execution identity while keeping the profile as the stable human-facing actor.

Verification

• pnpm lint (existing warnings only)
• pnpm typecheck
• prisma validate
• focused integration suite: 28/28
• complete Vitest suite
• production Next.js build
• Playwright: 52/52

Implements AXI-115.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fcd75bcee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".