refactor(runtime): move headless permission setup into the agent adapter

[FreshlyBrewedCode]

Part of #32 · Closes #37

allocateWorkspace and resetClone write opencode.json (permission: {"*": "allow"}) into every run tree — the fix for #24, a real production deadlock where a headless opencode serve parks a turn on a permission ask nobody can answer. That policy is entirely opencode's business; a git-shaped workspace allocator has no way to know it exists and no business knowing it. ADR 0012 §3 draws the line: the agent runtime prepares its own workspace, and lib/workspace.ts goes back to being about git.

What changed

• AgentAdapter gains prepareWorkspace(dir): Promise<void>; opencodeAdapter implements it by calling writeHeadlessPermissions (unchanged: still writes opencode.json and registers it in .git/info/exclude so writeBack never stages it). The replay/slow-fake test adapters no-op.
• startRun calls adapter.prepareWorkspace(dir) once, before workflow.run, gated by a new prepareWorkspace?: boolean option — so it runs before the first agent step regardless of which adapter is wired in.
• lib/workspace.ts and lib/clone.ts no longer import sandbox-config; allocateWorkspace's existsSync guard (only needed because workspace.test.ts's injected fake exec spawns nothing and leaves dir absent) is gone with the responsibility it was guarding.
• The flag is threaded to cover both clone paths: the daemon sets it when startTrackedRun itself ran allocateWorkspace (workspaceAllocated && kind === "clone"); the CLI and the legacy HTTP body.dir + body.clone path set it explicitly after calling resetClone. Scratch workspaces never set it, matching current behaviour (the pre-refactor code only ever wrote the config past the scratch early-return).
• sandbox-config.test.ts now drives opencodeAdapter.prepareWorkspace directly instead of going through resetClone; workspace.test.ts's now-obsolete opencode.json assertion is removed since that's no longer allocateWorkspace's job; run.test.ts adds coverage for both the true and absent prepareWorkspace cases.

Notes for reviewers

• Stack order note: this PR (Move headless permission setup out of the workspace allocator #37) sits below Add an Effect composition root and make the agent runtime a service #36 in the stack even though the epic lists Add an Effect composition root and make the agent runtime a service #36 first — both are blocked only by Move chunk interpretation into the agent adapter #35, and Move headless permission setup out of the workspace allocator #37 was sequenced first because Add an Effect composition root and make the agent runtime a service #36 (agent-runtime-as-a-service) is easier to land against a settled prepareWorkspace contract.
• The tail commit (fix: add prepareWorkspace to inline test adapters + gitignore tanstack artifacts) has a slightly misleading message — the agent-step.test.ts signalAdapter fix it describes actually landed in the prior commit (a4ccf3b). Its actual diff is just a .gitignore addition for .tanstack-projected-*/data/ plus deleting one empty file (data/src/factory/.factory/workspaces/run-.../.tanstack-projected-...) that a sandbox run had accidentally committed in the commit before it. Confirmed nothing else rode along — no functional change in that commit.
• Timing was the main thing worth checking on a relocated deadlock fix: for every path that reaches startRun with a clone workspace (daemon allocation, CLI --clone, legacy HTTP resetClone, and the schedule-trigger path which always goes through daemon allocation since it never sets dir), prepareWorkspace now runs synchronously before workflow.run, i.e. before any agent step can start. No path was found where a clone workspace reaches the first agent step without it.

Verification

• Tests added/updated: sandbox-config.test.ts (adapter-level), run.test.ts (prepareWorkspace true/absent), inline adapter fixtures across agent-step.test.ts/agent-step.usage.test.ts/replay/adapter.ts updated for the new interface member.
• CI (gh pr checks 55): check (format + lint + typecheck + bun test) passes, lint-title passes. I did not re-run bun run check locally; relying on CI's green result.

Stack

1. refactor(cli): replace hand-rolled parsers with effect/unstable/cli #52 — Parse CLI with Effect CLI (issue Parse CLI arguments with effect/unstable/cli #33)
2. refactor(errors): represent domain failures as Schema.TaggedError #53 — Domain errors as tagged errors (issue Represent domain failures as Schema.TaggedError #34)
3. refactor(runtime): move chunk interpretation into the agent adapter #54 — Move chunk interpretation into adapter (issue Move chunk interpretation into the agent adapter #35)
4. refactor(runtime): move headless permission setup into the agent adapter #55 — Move headless permission setup into the agent adapter (issue Move headless permission setup out of the workspace allocator #37) ← this PR
5. feat(runtime): add Effect composition root and agent runtime service #56 — Agent runtime service (issue Add an Effect composition root and make the agent runtime a service #36)
6. refactor(daemon): move singletons into per-daemon layers #57 — Move singletons into layers (issue Move the daemon's remaining singletons into layers #38)

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}