merge: integrate oss branch — budget gating, MCP back-channel, events, loopback-only bind

Key features from OSS branch:
- Budget gating: rolling per-provider spend caps with BUDGET_EXCEEDED task state
- Agent MCP back-channel: runners mint tokens; /mcp endpoint resolves them
- Chatbot MCP server at /chatbot/mcp (requires api_token in config)
- Event timeline: unified event stream replacing ad-hoc question/summary flows
- Loopback-only default bind (127.0.0.1:8484); external_bind_allowed=true to expose
- repository_url required on task creation (enforces traceability)
- Auto-checker: spawns verification task after each execution

Conflict resolutions:
- serve.go: keep cfg.Runners.XEnabled() conditional registration from main + agentRegistry from oss
- config.go: keep RunnersConfig from main + BudgetConfig/ExternalBindAllowed from oss
- server.go: handleStaticFiles (base-path rewrite) kept; deduplicated duplicate from both sides
- executor/claude.go: accepted oss deletion (ClaudeRunner replaced by ContainerRunner)
- container_test.go: added noopChannel + AgentChannel parameter to Run call

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 20 insertions, 10 deletions

diff --git a/internal/executor/preamble_test.go b/internal/executor/preamble_test.go
index 5c31b4f..77a8fca 100644
--- a/internal/executor/preamble_test.go
+++ b/internal/executor/preamble_test.go
@@ -5,27 +5,37 @@ import (
 	"testing"
 )
 
-func TestPlanningPreamble_ContainsFinalSummarySection(t *testing.T) {
-	if !strings.Contains(planningPreamble, "## Final Summary (mandatory)") {
-		t.Error("planningPreamble missing '## Final Summary (mandatory)' heading")
+func TestPlanningPreamble_ReferencesMCPTools(t *testing.T) {
+	for _, tool := range []string{"ask_user", "report_summary", "spawn_subtask", "record_progress"} {
+		if !strings.Contains(planningPreamble, tool) {
+			t.Errorf("planningPreamble should mention the %q tool", tool)
+		}
 	}
 }
 
-func TestPlanningPreamble_SummaryUsesFileEnvVar(t *testing.T) {
-	if !strings.Contains(planningPreamble, "CLAUDOMATOR_SUMMARY_FILE") {
-		t.Error("planningPreamble should instruct agent to write summary to $CLAUDOMATOR_SUMMARY_FILE")
+func TestPlanningPreamble_NoFileEscapeHatches(t *testing.T) {
+	for _, marker := range []string{"CLAUDOMATOR_SUMMARY_FILE", "CLAUDOMATOR_QUESTION_FILE"} {
+		if strings.Contains(planningPreamble, marker) {
+			t.Errorf("planningPreamble should no longer reference %s", marker)
+		}
 	}
 }
 
-func TestPlanningPreamble_SummaryInstructsEchoToFile(t *testing.T) {
-	if !strings.Contains(planningPreamble, `"$CLAUDOMATOR_SUMMARY_FILE"`) {
-		t.Error("planningPreamble should show example of writing to $CLAUDOMATOR_SUMMARY_FILE via echo")
+func TestPlanningPreamble_AskUserEndsTurn(t *testing.T) {
+	if !strings.Contains(planningPreamble, "end your turn") {
+		t.Error("planningPreamble should instruct the agent to end its turn after ask_user")
 	}
 }
 
 func TestPlanningPreamble_GitDiscipline_ForbidsAbsolutePaths(t *testing.T) {
-	// Agents must not bypass the sandbox by using absolute project paths in git commands.
 	if !strings.Contains(planningPreamble, "do NOT use absolute paths") {
 		t.Error("planningPreamble should warn agents not to use absolute paths in git commands")
 	}
 }
+
+func TestWithPlanningPreamble_PrependsToInstructions(t *testing.T) {
+	got := withPlanningPreamble("DO THE THING")
+	if !strings.HasPrefix(got, planningPreamble) || !strings.HasSuffix(got, "DO THE THING") {
+		t.Error("withPlanningPreamble should prepend the preamble to the instructions")
+	}
+}