Add conformance contracts for Agent Machine host interfaces

[mdheller]

Context

Secure Host Interfaces need conformance tests at the workstation boundary.

The host interface layer connects local terminal, browser, editor, and agent tool surfaces to an internal Podman-backed Agent Machine. This needs deterministic contracts and receipts, not just implementation code.

workstation-contracts already defines workstation/CI contracts, IPC v0 reference harnesses, deterministic transcripts, and run receipts. It is the right conformance home for host-interface adapter behavior.

Scope

Add workstation contract fixtures for:

• terminal PTY attach envelope
• browser broker request/response envelope
• editor broker request/response envelope
• agent tool broker envelope for OpenCLAW/OpenClaw and Hermes
• deny-by-default cases
• grant expiration and revocation cases
• evidence receipt shape

Acceptance criteria

• Schemas or fixtures validate with existing repo validation flow.
• IPC transcript examples show broker handshake and capability negotiation.
• Receipts include workspace id, interface kind, policy hash, grant id, denial/allow result, and redaction summary.
• No production runner implementation added here.
• No secrets or local machine paths committed.

Non-goals

• Do not implement the production broker.
• Do not vendor VS Code, browser-use, OpenCLAW, or Hermes code.
• Do not define SourceOS canonical schemas here if they belong in sourceos-spec.

[mdheller]

SourceOS Agent Machine Local Data Plane schemas/examples are now available in SourceOS-Linux/sourceos-spec on main.

Conformance tests should reference:

• schemas/AgentMachineLocalDataPlane.json
• schemas/AgentMachineMountPolicy.json
• schemas/TopoLVMPlacementProfile.json
• examples/agent_machine_local_data_plane_macos.json
• examples/agent_machine_mount_policy_default.json
• examples/topolvm_placement_profile_agent_machine.json

Suggested conformance receipts:

1. Permit ~/dev -> /workspace/dev as code root when a grant exists.
2. Permit ~/Documents/SourceOS/agent-output -> /workspace/output as documents root when a grant exists.
3. Permit ~/Downloads/SourceOS/agent-downloads -> /workspace/downloads as downloads root with browser read/write and agent read-only.
4. Deny $HOME wholesale mount.
5. Deny .ssh, .gnupg, browser profile dirs, keychains, cloud credential dirs, token stores, and password stores.
6. Emit deterministic IPC transcript and run receipt for mount plan generation and denial cases.