feat(omnigent): managed hosts and automatic Gateway setup

[dgokeeffe]

Summary

• add opt-in server-managed OmniGENT host leasing with generation fencing and per-session workspaces
• authenticate managed control calls as the configured OmniGENT server service principal
• reap abandoned leases, expose bounded authorised diagnostics, and sanitise browser status
• automatically attach READY Foundation Model chat endpoints to CoDA with least-privilege CAN_QUERY
• remove static Claude/Pi model pins and adopt ucode's native discovery + model override contract
• fail setup visibly instead of silently falling back to an inaccessible Sonnet model

Activation and compatibility

Managed OmniGENT remains inert unless an approved deployment sets CODA_OMNIGENT_MODE=managed and configures OMNIGENT_SERVER_SP_CLIENT_ID. Attached OmniGENT resources alone do not activate it.

Gateway model resources are refreshed by the normal deploy targets. Set AUTO_CONFIGURE_GATEWAY=false only when endpoint permissions are managed externally. Existing unrelated app resources are preserved; embeddings and non-Foundation-Model endpoints are excluded.

Validation

• focused managed-host/auth/Gateway/configuration suites: 187 passed before the bounded-resource-name follow-up
• resource-name regression suite: 3 passed
• uv lock --check — passed
• git diff --check origin/main...HEAD — passed
• DaveOK coda: 11 READY chat endpoints attached with CAN_QUERY; idempotent second refresh succeeded
• DaveOK deployment 01f1a612ae9315b9b205506c24c642c4 at 01297c6: SUCCEEDED, app RUNNING
• full local uv run pytest -q previously exceeded the five-minute local execution limit; CI should provide the complete result

Deployment note

No managed OmniGENT server/volume resources are enabled by this PR. Gateway permissions are bounded to CAN_QUERY on currently READY chat endpoints.