fix(managed-agents): apply Claude Code agent config via ACP/env; respect CLAUDE_CONFIG_DIR

[wpfleger96]

Fixes five agent-config gaps for Claude Code managed agents in Buzz Desktop.

What this changes

A1 — Model authority for local and remote Claude spawns

apply_claude_model_env in runtime.rs sets ANTHROPIC_MODEL from the agent's effective model and removes BUZZ_ACP_MODEL from the child env (Desktop owns model selection; ACP is the live-switch channel only). Remote Claude deploys add ANTHROPIC_MODEL to policy_env via agents_deploy.rs; BUZZ_ACP_MODEL is never injected remotely. Contract tests cover both the local inject-and-remove path and the remote Claude/non-Claude cases.

B5 — Effort end-to-end via ACP

Pool-level desired effort. A single AgentPool::desired_effort is the sole authority. set_pool_effort stores the value and invalidates all idle sessions; clear_pool_effort resets to None and also invalidates. Every try_claim copies the pool's current value onto the checked-out agent so all workers converge immediately — busy workers apply it at their next session.

Provisional picks with commit/rollback. AgentPool::committed_effort tracks the last adapter-confirmed value. A pick is provisional until create_session_and_apply_model resolves: on ok → commit committed_effort; on failure → roll back desired_effort to committed_effort so the failed candidate is never recopied by try_claim or retried. A monotonic effort_generation counter lets return_agent distinguish the current pick from superseded ones — stale-generation results are discarded without touching committed state.

Startup default. record.effort_level is injected as BUZZ_ACP_EFFORT_LEVEL at local spawn (runtime.rs) and into policy_env at remote deploy (agents_deploy.rs). The harness reads it into PoolStartup.startup_effort; resolve_startup_effort() arms desired_effort after capabilities arrive at the first session creation, using the capabilities-derived thought_level_config_id. return_agent propagates a startup-resolved effort back to pool level only when no live pick or clear has ever been made (effort_ever_picked = false), preventing resurrection of a cleared value.

Two-phase acks for both pick and clear. handle_set_config_option_control:

• Non-empty valid value → pending_session immediate ack (pool stored); final ok/failure arrives from create_session_and_apply_model after the real ACP call.
• Empty value (Auto/clear) → pending_session immediate ack (pool cleared to None); final cleared ack arrives from create_session_and_apply_model when the session runs without an effort override.
• Value not in adapter-advertised options → invalid_value ack; pool unchanged.

Per-request nonce correlation. The Desktop generates a crypto.randomUUID() nonce per pick/clear and passes it in the control frame. The harness echoes it in all acks (immediate and final). awaitEffortOutcome uses the nonce as the primary correlation key, rejecting acks where frame.nonce !== nonce; this prevents a stale ack from a same-value pick arriving late or from a superseded request settling the wrong promise. The observer persistence gate also checks the registered nonce, so late acks (e.g. after the 8s timeout) cannot overwrite a newer persisted value.

Observer persistence. dispatchControlResult persists on ok + thought_level (final applied) or cleared + thought_level (final clear confirmed); all other statuses (including pending_session and failure) do not persist. The nonce gate adds a second layer: mismatched nonces are silently dropped.

EffortPicker. Subscribes to control_result before sending (no dropped acks), awaits the correlated final result via awaitEffortOutcome with an 8-second timeout, surfaces pending_session / failure / invalid_value status messages, and invalidates both managedAgentsQueryKey and agentConfigSurfaceQueryKey on ok/cleared. Options come from the adapter-advertised effortOptions (exported through RuntimeConfigSurface; extract_agent_config_options retains both "model" and "thought_level" entries so the pool-level capability cache and the harness invalid_value guard work in production); falls back to low/medium/high for older adapters.

PermissionMode Auto

config.rs adds Auto to the PermissionMode enum and tests coverage in crates/buzz-acp.

#3493 — Respect user-set CLAUDE_CONFIG_DIR

config_bridge resolves both settings.json and .claude.json panel paths from the agent's effective env via resolve_effective_agent_env (full tier chain: baked floor → definition env → global → persona → record). mcp_config_file_path_for_runtime honors the resolved custom dir; empty/blank values are treated as unset (matching Claude's CLAUDE_CONFIG_DIR || homedir() semantics). agent_config.rs routes through the same effective-env path so the panel and the process cannot diverge on which dir is active. AgentConfigPanel shows a Keychain-logout caveat when a custom dir is in effect (Claude behavior, not Buzz's).

Scope explicitly excluded

Per-agent config dir provisioning, CLAUDE_SECURESTORAGE_CONFIG_DIR sentinel injection, settings.json projection, protected-key stripping, B8 MCP inheritance, spawn serialization, and last_spawn_warnings surface are absent from this diff. Silent-fallback machinery for non-Claude runtimes (#2265/#4004) is a tracked follow-up.

Closes #2692, #2884, #3493