feat(agents): add built-in platform agents for common roles

[sytone]

Closes #467

Changes

Adds BuiltInAgentConfigurationSource providing 6 always-available platform agents:

Agent	Role	Tools
researcher	researcher	web_search, web_fetch, memory_search, read, glob, grep
coder	coder	read, write, edit, glob, grep, shell, exec, process, watch_file
planner	planner	memory_search, memory_save, memory_get, web_search, read, write
reviewer	reviewer	read, glob, grep, shell, web_fetch, memory_search
writer	writer	read, write, edit, glob, grep, web_search, web_fetch, memory_search
analyst	analyst	read, glob, grep, shell, exec, web_fetch

Each agent has metadata.role matching its ID, making it grantable via SubAgentRoles.

Registered in AddBotNexusGateway() alongside the AgentConfigurationHostedService, before file/platform config sources. The code-based agent guard in AgentConfigurationHostedService.StartAsync ensures config-file agents with the same ID are skipped.

Tests

34 new unit tests covering:

• All 6 agents present
• Tool inclusion and exclusion (researcher/reviewer read-only)
• Role metadata matches agent ID
• System prompt + description completeness
• Watch() returns null (static source)

[sytone]

CI fix: ToolDefaultTimeout_SmallerThanSafetyCap_SafetyCapWins was flaking on slow CI runners. The 200ms task with 500ms safety cap had insufficient margin. Bumped to 400ms task / 2000ms safety cap. All 1670 gateway + full suite pass locally.

[sytone]

Farnsworth review — PR #485

• CI: was failing (ToolExecutorTimeoutTests timing flake) — fixed this run, CI re-running
• Conflicts: CLEAN / MERGEABLE
• Commit title: feat(agents): add built-in platform agents for common roles ✅ conventional
• Test coverage: 34 tests covering each built-in agent registration, tool restrictions, metadata.role wiring ✅
• Spec completeness: Closes [Agents] Built-in internal agents for common roles #467 — 6 always-available agents (researcher, coder, planner, reviewer, writer, analyst) with ToolIds restrictions and SubAgentRoles grants ✅

LGTM pending CI green.

[sytone]

CI: All checks passing
Merge conflicts: Clean / MERGEABLE
Commit title: Conventional commit format correct
Coverage: 34 tests for BuiltInAgentConfigurationSource, tool restrictions, metadata.role
Spec completeness: Closes #467 - 6 built-in platform agents (researcher, coder, planner, reviewer, writer, analyst) with tool restrictions and SubAgentRoles grants

LGTM - ready to merge.

[sytone]

Farnsworth Review — PR #485

CI: ✅ All checks passing
Merge conflicts: ✅ Clean (MERGEABLE)
Conventional commit title: ✅ feat(agents): add built-in platform agents for common roles

Test coverage:

• ✅ 34 tests (6 built-in agents: researcher, coder, planner, reviewer, writer, analyst)
• Tool restriction enforcement, metadata.role wiring, BuiltInAgentConfigurationSource registration
• Tests pass

Spec completeness vs #467: All 6 built-in agents implemented with tool restrictions and SubAgentRoles metadata. BuiltInAgentConfigurationSource registered in AddBotNexusGateway().

LGTM. Ready to merge.

[sytone]

Closing as part of a planned hard-reset of the in-flight branch set so the new domain-model refactor can land on a clean trunk.

Audit verdict: close

Rationale: Adds AgentDescriptors using the current SessionParticipant/SessionType shape. Re-add after Phase 1.5 (Citizen) lands so agents implement ICitizen from day one.

The new plan (in session state) reshapes core types: Citizen (User+Agent union), Vogen-generated value objects, ThreadId removed in favour of composite ChannelAddress, mark-not-delete compaction, centralised SessionContextProjector, single-path routing. Many in-flight branches touch contracts that are about to change — rebasing later would be more work than rebuilding on the new shape.

If this work is still wanted, refile as a new issue/PR against the post-refactor contracts.