Refuse a shell the database, show a screen that ended, and unblock a taken-over sign-in

[davidmckayv]

Fixes five issues left open after the 0.0.5 triage that were validated as still reproducing on main and in-spirit for the template. Bundled at request; each fix is independent and could be split.

Closes #226, closes #287, closes #275, closes #199.

What each fix does

• A Bot's shell has passwordless owner access to the database in the all-in-one image #226 — the embedded database no longer trusts an unauthenticated connection. In the all-in-one image the cluster was initdb -A trust -U openbot on loopback, and the Bot's shell runs in the same container, so it could psql -h 127.0.0.1 -U openbot with no password and reach the audit trail, policy store, and credential vault as the owner. Now scram-sha-256 with a password generated on first init, kept beside the data on the same volume, and handed to api/migrate over the container environment. The shell's environment is an allow-list that does not carry the URL, and the password file is 600/postgres, so the shell cannot learn it. External-DATABASE_URL deployments are untouched (EMBEDDED_POSTGRES=off exits early).
• A live screen that ends tells the app, and the app renders it in the branch it is not in #287 — a live screen that ends now says so. The end-of-screen reason was drawn only by NothingToSee, which the take-the-wheel view does not mount, so the screen froze on its last frame. It is now rendered in the live-screen branch.
• A Bot's browser announces itself as HeadlessChrome with webdriver true, so Google refuses sign-in even when a person takes the wheel #275 — the browser drops its automation flags. --disable-blink-features=AutomationControlled + ignoreDefaultArgs: ["--enable-automation"], so a person who takes the wheel can sign in to a site that refuses obvious automation. This is the flag, not a JS patch of navigator.webdriver. See the deferral below.
• Intelligence-mode runs break with strict providers (z.ai GLM / Anthropic): delta-only messages, silent empty replies, LangChain-shaped tool calls in history #199 (parts 1 & 2) — strict providers stop failing silently. A run with no human turn now carries a neutral continuation (z.ai GLM / Anthropic reject a delta-only history), and an empty model reply ends on a visible line instead of END with nothing on screen. OpenAI is unchanged. (Part 3 was already fixed on main.)
• Add built-in agent acceptance test and bounded local Hermes bridge #219 (Half A) — a built-in-agent AG-UI acceptance test. Drives the real endpoint against a stand-in model: a token is required, an ordinary prompt comes back as readable text, and no secret is disclosed. (Half B, the Hermes bridge, is vendor-specific and stays closed.)

Verification — honest about depth

Three of these can only be fully proven by a CI image build or a live provider; the agent processes (agent-bot, agent-langgraph, agent-computer) also can't boot in a bare worktree due to workspace dep hoisting. So:

Fix	Verified locally	Gated to CI
all	lint 0, typecheck 0 (all packages), build 0	—
#226	scram core proven against a real Postgres: with the password select 1 returns 1; without it, and as a non-postgres OS user (the Bot shell's case), the connection is refused. postgres-init.sh parses (sh -n).	the s6 wiring (password propagation via with-contenv, persistence across restart) needs the assembled image
#287	typecheck + build + review; renders problem in the mounted branch	the live-screen-end state needs agent-computer running
#275	typecheck + review of the launch config	the assembled browser's behavior needs the image
#199	typecheck; logic reviewed	agent-langgraph unit tests need @langchain/core (CI has it)
#219	test written to the endpoint's real contract	the test spawns agent-bot, which needs @ag-ui (CI runs it)

Deliberate deferrals (not silent gaps)

• A Bot's browser announces itself as HeadlessChrome with webdriver true, so Google refuses sign-in even when a person takes the wheel #275 still reports HeadlessChrome in the user agent, which only running headed under a virtual display (Xvfb) removes — a heavier image change that can't be verified without a build and changes the browser's resource profile. This PR takes the low-risk signal reduction; the headed-Xvfb change is worth its own PR.
• A Bot's shell has passwordless owner access to the database in the all-in-one image #226 closes the passwordless hole. A further hardening — a non-owner role for the API so the append-only audit trigger cannot be dropped even with the password — is a larger role/migration change and is not attempted here.