feat(agent): implement runtime listener and client RPC calls

[adolago]

Summary

• Replace agent runtime stubs with a real JSON request/response listener that supports TCP and Unix socket addresses.
• Implement runtime request handling for ping, status, execute, and shutdown.
• Implement AgentClient RPC transport with timeout handling, response validation, and result decoding.
• Add agent RPC tests covering not-running behavior and live request/response roundtrip over TCP.

Closes #789

Testing

• cargo test agent::tests -- --nocapture
  • agent::tests::test_agent_client_not_running_for_unbound_tcp_address ... ok
  • agent::tests::test_agent_runtime_client_rpc_roundtrip_over_tcp ... ok

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a70da8a37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Don't terminate runtime on single connection I/O failure

In serve_tcp (and similarly in serve_unix), self.handle_connection(stream).await? propagates per-client read/write errors out of the accept loop and stops the entire agent runtime. A malformed client that disconnects after sending partial JSON can cause handle_connection/write_response to return a connection error (for example BrokenPipe), after which start() exits and all subsequent clients lose service. Per-connection protocol/I/O failures should be handled locally so one bad client cannot take down the listener.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Validate auth token before dispatching RPC methods

AgentConfig and AgentClient::with_auth_token imply token-gated RPC access, but request handling immediately dispatches methods without any authentication check. With the new live listener, a reachable socket can now execute commands or trigger shutdown regardless of configured auth_token, which breaks the documented security expectation for protected deployments.

Useful? React with 👍 / 👎.