merge: integrate oss branch — budget gating, MCP back-channel, events, loopback-only bind

Key features from OSS branch:
- Budget gating: rolling per-provider spend caps with BUDGET_EXCEEDED task state
- Agent MCP back-channel: runners mint tokens; /mcp endpoint resolves them
- Chatbot MCP server at /chatbot/mcp (requires api_token in config)
- Event timeline: unified event stream replacing ad-hoc question/summary flows
- Loopback-only default bind (127.0.0.1:8484); external_bind_allowed=true to expose
- repository_url required on task creation (enforces traceability)
- Auto-checker: spawns verification task after each execution

Conflict resolutions:
- serve.go: keep cfg.Runners.XEnabled() conditional registration from main + agentRegistry from oss
- config.go: keep RunnersConfig from main + BudgetConfig/ExternalBindAllowed from oss
- server.go: handleStaticFiles (base-path rewrite) kept; deduplicated duplicate from both sides
- executor/claude.go: accepted oss deletion (ClaudeRunner replaced by ContainerRunner)
- container_test.go: added noopChannel + AgentChannel parameter to Run call

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 3 insertions, 31 deletions

diff --git a/internal/api/server_test.go b/internal/api/server_test.go
index 2530d55..43d91b0 100644
--- a/internal/api/server_test.go
+++ b/internal/api/server_test.go
@@ -98,7 +98,7 @@ func testServerWithRunner(t *testing.T, runner executor.Runner) (*Server, *stora
 		"gemini": runner,
 	}
 	pool := executor.NewPool(2, runners, store, logger)
-	srv := NewServer(store, pool, logger, "claude", "gemini")
+	srv := NewServer(store, pool, nil, logger, "claude", "gemini")
 	return srv, store
 }
 
@@ -116,7 +116,7 @@ func (m *mockRunner) ExecLogDir(execID string) string {
 	return filepath.Join(m.logDir, execID)
 }
 
-func (m *mockRunner) Run(ctx context.Context, t *task.Task, e *storage.Execution) error {
+func (m *mockRunner) Run(ctx context.Context, t *task.Task, e *storage.Execution, _ executor.AgentChannel) error {
 	if e.ID == "" {
 		e.ID = uuid.New().String()
 	}
@@ -194,7 +194,7 @@ func testServerWithGeminiMockRunner(t *testing.T) (*Server, *storage.DB) {
 		"gemini": mr,
 	}
 	pool := executor.NewPool(2, runners, store, logger)
-	srv := NewServer(store, pool, logger, "claude", "gemini")
+	srv := NewServer(store, pool, nil, logger, "claude", "gemini")
 	return srv, store
 }
 
@@ -1228,34 +1228,6 @@ func TestServer_AnswerQuestion_UpdateStateFails_Returns500(t *testing.T) {
 	}
 }
 
-func TestRateLimit_ElaborateRejectsExcess(t *testing.T) {
-	srv, _ := testServer(t)
-	// Use burst-1 and rate-0 so the second request from the same IP is rejected.
-	srv.elaborateLimiter = newIPRateLimiter(0, 1)
-
-	makeReq := func(remoteAddr string) int {
-		req := httptest.NewRequest("POST", "/api/tasks/elaborate", bytes.NewBufferString(`{"description":"x"}`))
-		req.Header.Set("Content-Type", "application/json")
-		req.RemoteAddr = remoteAddr
-		w := httptest.NewRecorder()
-		srv.Handler().ServeHTTP(w, req)
-		return w.Code
-	}
-
-	// First request from IP A: limiter allows it (non-429).
-	if code := makeReq("192.0.2.1:1234"); code == http.StatusTooManyRequests {
-		t.Errorf("first request should not be rate limited, got 429")
-	}
-	// Second request from IP A: bucket exhausted, must be 429.
-	if code := makeReq("192.0.2.1:1234"); code != http.StatusTooManyRequests {
-		t.Errorf("second request from same IP should be 429, got %d", code)
-	}
-	// First request from IP B: separate bucket, not limited.
-	if code := makeReq("192.0.2.2:1234"); code == http.StatusTooManyRequests {
-		t.Errorf("first request from different IP should not be rate limited, got 429")
-	}
-}
-
 func TestListWorkspaces_RequiresAuth(t *testing.T) {
 	srv, _ := testServer(t)
 	srv.SetAPIToken("secret-token")