feat(chat): explicitly select authorized attached Agents in private chat

[huangruiteng]

Private Chat currently selects an executor endpoint but cannot explicitly address an existing registered Agent. This adds App-scoped grants for exact attached Sessions in the selected workspace. Settings authorizes the existing Goal/Agent/Session/host; /agents lists usable grants, /agent <target-ref> selects one, and /project returns to the original ordinary conversation. Follow-ups enter the original canonical queue, are claimed/completed by that host, and return to the original App/source without launching another adapter.

The typed binding owner validates registration, workspace, Goal lifetime and host identity. Queue admission and host claim preserve the grant fence; revoked pending work cannot execute. Persisted Session/host audience stamps also refuse reassignment through another Session or App after revocation. Request routing survives crash/replay and recipient changes. The current attached broker cannot push interrupt or create a host Session, so /stop and /new report that limitation explicitly. Normal workspace Chat still creates no hidden Goal. No new roles or inherited state are bootstrapped.

Dependencies: stacked on #5544 at 2b83fa8e1b6530caa3bc608e9014cb12c9b3732a; its existing #5540–#5542 prerequisites remain unchanged. This diff does not duplicate #5538 or independent service-owner fix #5543. Runtime/authority changes remain for maintainer review and merge.

Validation at head e05382373f21e4660fdc8377af109264fa9ecc9f:

• 240 related Python tests passed, including six provider/native-store/HTTP journeys, ordinary/steward regressions, attached broker/lifetime cases, import boundaries, semantic drift and maintainability.
• 11 typed Core tests, control-plane/dashboard type checks, packaged Chat build, Ruff and configured Mypy (19 files) passed. Registry I/O census: 278 sites, zero unclassified; semantic development advisory executed.
• Risk-selected premerge passed five direct checks and all sixteen selected checks. No self-merge authority was granted.
• All six private Agent journeys passed against an isolated installed wheel; imports of the production store, runtime, binding/request owners and attached broker were verified under that wheel. Installed metadata is 1.2.4, with the source head separately recorded; this is not release attestation or formal promotion. The formal CLI and actual App listeners were not replaced.

Fixtures use synthetic App/owner identities, provider responses and protocol/attached-host execution. They do not prove a live Agent subscription, mobile experience, new roles, formal installation/login recovery, streaming/media/permission interactions or broader steward coordination. GitHub CI is pending and is not substituted by local tests.

中文：本增量补齐项目私聊的显式 Agent 目标授权与选择；后续消息沿用原 attached 宿主、原 canonical Session 和队列，结果回到原 App/source。共享 Core 核验确切身份、工作区、Goal lifetime 与受众，撤销后拒绝尚未领取的消息；同一宿主持续对话不能换给另一个 App。已受理工作在切换或崩溃后保持原目标，当前不支持的停止/新建操作明确反馈。240 项 Python、11 项 Core、类型/构建/质量及 premerge 检查通过；真实宿主自动领取、手机、正式安装和更广管家协调仍待验收，留维护者评审合并。

CI checkpoint (exact head e053823)

GitHub run 37167987116 ended with 27 checks successful, 7 skipped and 6 failed. Python reported 73 unique failing test names, including two names absent from the preceding status increment: retry-safe typed-write recovery after runtime exit, and delegation preview lifetime retirement. Both targeted tests pass locally on exact main and the composed candidate; that does not explain or waive the Linux CI failures.

当前 exact head 的 CI 未通过：73 个失败测试名，比前一增量多两条。新增两条分别在确切 main 和本地组合候选独立通过，尚未复现其 Linux CI 失败，不作基线归因或豁免。另一个已在 main 复现的失效 inventory 锚点由独立 #5548 修复。

A local candidate combining this stack, installation fix #5543 and inventory repair #5548 passes 629 relevant Python tests and premerge (5 direct, 19 selected); an isolated installed wheel passes 12 Agent/status/recovery journeys. These are local qualification evidence, separate from exact-head CI, live provider, mobile, or release installation.