Fix agent startup continuation and GitHub MCP token fallback

[jorisjonkers-dev-agents]

Summary

• stop new interactive agent sessions from implicitly resuming prior native Claude/Codex sessions
• bypass Codex hook-trust prompts for managed interactive and headless runs
• let GitHub MCP token minting infer repoUrl from the workspace git remote when REPO_URL is not forwarded

KB alignment

• follows decision 01KT90SQ3MGRSYQ52W9YC4MJS6: interactive starts must be fresh; explicit continuation remains separate

Tests

• ./gradlew :services:agent-gateway:test --tests '*AgentSessionManagerTest' --tests '*HeadlessJobManagerTest' --tests '*AgentControllerTest'\n- ./gradlew :services:assistant-api:test --tests '*StartAgentSessionCommandHandlerTest' --tests '*StartHeadlessJobCommandHandlerTest'\n- ./gradlew :platform:tooling:test --tests '*PlatformAgentMcpFluxTest'\n- bash -n services/agent-runner/agent-github-token.sh services/agent-runner/gh-mcp-wrapper.sh services/agent-runner/entrypoint.sh\n- git diff --check main..HEAD