feat(executor): introduce AgentChannel seam for runner signals

Defines AgentChannel — the normalized interface by which a runner reports
agent-originated signals (AskUser, ReportSummary, SpawnSubtask,
RecordProgress) — plus a default storeChannel implementation backed by
storage. Runner.Run now takes an AgentChannel; the pool constructs one
per execution.

The file transport routes its post-exit summary detection through
ch.ReportSummary (buffered onto the execution so the pool still applies
its extract/synthesize fallbacks, no double-write). AskUser returns
ErrAgentBlocked since write-and-exit cannot answer in-session; question
persistence stays with the pool's BlockedError handling. SpawnSubtask
and RecordProgress are implemented and tested, ready for the MCP
transport in Phase 2 where the channel becomes fully load-bearing.

Store gains CreateEvent so the channel can emit agent_message events.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39

1 files changed, 6 insertions, 6 deletions

diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index f0b2a3a..5ee3a3c 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -139,7 +139,7 @@ func TestContainerRunner_Run_PreservesWorkspaceOnFailure(t *testing.T) {
 	}
 	exec := &storage.Execution{ID: "test-exec", TaskID: "test-task"}
 
-	err := runner.Run(context.Background(), tk, exec)
+	err := runner.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID, exec))
 	if err == nil {
 		t.Fatal("expected error due to mocked docker failure")
 	}
@@ -378,7 +378,7 @@ func TestContainerRunner_MissingCredentials_FailsFast(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "test-exec", TaskID: "test-missing-creds"}
 
-	err := runner.Run(context.Background(), tk, e)
+	err := runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
 	if err == nil {
 		t.Fatal("expected error due to missing credentials, got nil")
 	}
@@ -418,7 +418,7 @@ func TestContainerRunner_MissingSettings_FailsFast(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "test-exec-2", TaskID: "test-missing-settings"}
 
-	err := runner.Run(context.Background(), tk, e)
+	err := runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
 	if err == nil {
 		t.Fatal("expected error due to missing settings, got nil")
 	}
@@ -504,7 +504,7 @@ func TestContainerRunner_AuthError_SyncsAndRetries(t *testing.T) {
 	e := &storage.Execution{ID: "auth-retry-exec", TaskID: "auth-retry-test"}
 
 	// Run — first attempt will fail with auth error, triggering sync+retry
-	runner.Run(context.Background(), tk, e)
+	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
 	// We don't check error strictly since second run may also fail (git push etc.)
 	// What we care about is that docker was called twice and sync was called
 	if callCount < 2 {
@@ -550,7 +550,7 @@ func TestContainerRunner_ClonesStoryBranch(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "exec-1", TaskID: "story-branch-test"}
 
-	runner.Run(context.Background(), tk, e)
+	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
 	os.RemoveAll(e.SandboxDir)
 
 	// Assert git checkout was called with the story branch name.
@@ -597,7 +597,7 @@ func TestContainerRunner_ClonesDefaultBranchWhenNoBranchName(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "exec-2", TaskID: "no-branch-test"}
 
-	runner.Run(context.Background(), tk, e)
+	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
 	os.RemoveAll(e.SandboxDir)
 
 	for _, a := range cloneArgs {