Scion/harness refactor

[ptone]

Establish a optional set of harness configs that support script based install

[gemini-code-assist]

Code Review

This pull request decouples the OpenCode, Codex, and Antigravity harnesses from the core Scion binary, relocating them to a top-level harnesses/ directory as self-contained bundles and shrinking the default-install set to Claude and Gemini. The built-in Go implementations for OpenCode and Codex are removed, and upgrade paths are introduced to migrate legacy configurations. Feedback on these changes highlights several critical improvements: enforcing the AGY_KEYRING_TOKEN requirement for the Antigravity vertex-ai auth type, adding a defensive nil check during YAML unmarshaling to prevent a runtime panic, falling back to opts.Name in the harness resolver to ensure warnings are printed for uninstalled harnesses, removing dead keyring functions in the Antigravity provisioner, and cleaning up the enterprise_marker file when switching auth modes to avoid incorrect state persistence.

[gemini-code-assist]

The vertex-ai auth type requires the AGY_KEYRING_TOKEN secret to be present and validated (as enforced in provision.py), but its definition here is empty ({}). Without specifying required_env, the Scion orchestrator may not enforce or inject the required AGY_KEYRING_TOKEN secret when vertex-ai is selected, leading to runtime failures. Add required_env with AGY_KEYRING_TOKEN to match the requirements of oauth-token.

    vertex-ai:
      required_env:
        - any_of: ["AGY_KEYRING_TOKEN"]

[gemini-code-assist]

If configData is empty or contains only comments, yaml.Unmarshal will succeed without error but leave cfg as nil. Accessing cfg["harness"] on a nil map will cause a runtime panic. Add a defensive nil check for cfg before accessing its keys.

Suggested change

	var cfg map[string]interface{}
	if err := yaml.Unmarshal(configData, &cfg); err != nil {
	return plan, nil
	}
	harnessName, _ := cfg["harness"].(string)
	var cfg map[string]interface{}
	if err := yaml.Unmarshal(configData, &cfg); err != nil {
	return plan, nil
	}
	if cfg == nil {
	return plan, nil
	}
	harnessName, _ := cfg["harness"].(string)

[gemini-code-assist]

If hcDir is nil (meaning the harness is not installed), entry is empty, so entry.Harness is "". Consequently, the outer if condition entry.Harness == "opencode" || entry.Harness == "codex" will evaluate to false, and the warning hint for uninstalled harnesses will never be printed. To fix this, resolve the harness name using opts.Name as a fallback when entry.Harness is empty.

Suggested change

	if entry.Harness == "opencode" || entry.Harness == "codex" {
	if hcDir == nil {
	slog.Warn("harness is not installed; run: scion harness-config install harnesses/"+entry.Harness, "harness", entry.Harness)
	} else if entry.Provisioner == nil || entry.Provisioner.Type != "container-script" {
	hint := "run: scion harness-config upgrade " + opts.Name + " --activate-script"
	if !fileExistsInDir(hcDir.Path, "provision.py") {
	hint = "run: scion harness-config install harnesses/" + entry.Harness
	}
	slog.Warn("legacy built-in harness config no longer has a compiled-in implementation; "+hint,
	"harness", entry.Harness, "config_dir", hcDir.Path)
	}
	}
	harnessName := entry.Harness
	if harnessName == "" {
	harnessName = opts.Name
	}
	if harnessName == "opencode" || harnessName == "codex" {
	if hcDir == nil {
	slog.Warn("harness is not installed; run: scion harness-config install harnesses/"+harnessName, "harness", harnessName)
	} else if entry.Provisioner == nil || entry.Provisioner.Type != "container-script" {
	hint := "run: scion harness-config upgrade " + opts.Name + " --activate-script"
	if !fileExistsInDir(hcDir.Path, "provision.py") {
	hint = "run: scion harness-config install harnesses/" + harnessName
	}
	slog.Warn("legacy built-in harness config no longer has a compiled-in implementation; "+hint,
	"harness", harnessName, "config_dir", hcDir.Path)
	}
	}

[gemini-code-assist]

The functions _provision_keyring, _init_keyring, and _store_keyring_token are defined but never called anywhere in the codebase. This dead code appears to be a leftover from when the keyring initialization and token storage logic was moved into the generated shell script agy-wrapper.sh (inside _generate_wrapper_script). Removing these unused functions will improve code maintainability and readability.

[gemini-code-assist]

During idempotent reprovisioning, if a user switches the auth mode from vertex-ai to oauth-token, the previously created enterprise_marker file will persist. This will cause the wrapper script to incorrectly continue running in enterprise/GCP mode. Clean up the marker file if is_enterprise is False.

    if is_enterprise:
        os.makedirs(os.path.dirname(enterprise_marker), exist_ok=True)
        with open(enterprise_marker, "w") as f:
            f.write("1")
    else:
        try:
            os.remove(enterprise_marker)
        except FileNotFoundError:
            pass