feat(acp): connect registry providers to shared sign-in flows

[juliusmarminge]

Registry-installed ACP providers need a consistent account setup path instead of requiring users to discover the correct CLI login command themselves.

Discover advertised authentication methods and connect them to the shared sign-in flow, including browser consent and interactive terminal login. Verify authentication with a fresh ACP session and refresh methods after runtime updates. Credentials remain in each agent's native store; credential changes coordinate all instances sharing that agent's binding.

Managed runtimes use tools/<agent-id>/<version>/ inside T3 home, including isolated npm and Python installs. Launch the registry version by default; existing PATH binaries require an explicit executable override. Mistral retry notifications update the existing retry UI, and structured ACP errors retain the provider's error message.

Depends on #12966.

Validation: 131 focused catalog, driver, authentication, adapter, and terminal tests passed for managed installs. Scoped server typecheck and targeted lint passed (one existing lint warning). A real managed Mistral binary returned version 2.25.5 through ACP initialize. Earlier integrated stack validation passed 231 focused tests.

Latest restacked validation: 219 focused ACP/Cursor backend tests and 63 provider-settings web tests pass. Scoped server and web typechecks pass.

Live ACP sign-in and before/after UI evidence are pending. The V2 selection-restart CI failure is tracked by #13113. This PR remains a draft.

Implemented with GPT-6 in the Codex harness.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.7 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: c4ba935 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Effect Service Conventions found one issue in apps/server/src/provider/Drivers/AcpRegistryDriver.ts: AcpRegistryAuth and AcpRegistryAuthenticationState are imported as named constructors rather than service-module namespaces. An inline review comment was posted with the expected fix.

^{Posted via Macroscope — Effect Service Conventions}