test(harness): add Phase 2 replay and gateway coverage

[serrrfirat]

Summary

• add deterministic replay coverage for approval flows
• add deterministic replay coverage for auth-gate flows
• add a gateway-ops trace replay harness with committed fixture coverage
• add engine-v2 caller-level router coverage for text-based auth fallback handling

Included in this PR

Approval replay fixtures

• adds approval replay fixtures and assertions for yes/no/always/slash-command handling
• expands coverage for missing approval scenarios and persistence behavior

Auth-gate replay fixtures

• adds auth-gate replay fixtures covering credential submission, invalid-then-valid retry, external callback, cancellation, and request-id emission

Gateway trace replay harness

• adds tests/support/trace_runner.rs
• adds tests/e2e_gateway_trace_harness.rs
• adds committed gateway trace fixtures under tests/fixtures/gateway_traces/
• covers echo roundtrip, assertion mix, idempotency, persisted action records, deterministic replay, and unknown-tool failure handling

Engine-v2 caller-level runtime-boundary coverage

• adds router tests for handle_with_engine_inner() text-based auth fallback
• verifies registered credentials produce BridgeOutcome::Pending + StatusUpdate::AuthRequired
• verifies unregistered or invalid credential names fall back to plain response text instead of creating auth gates

Refs #2828
Refs #643

Testing

• cargo test --features libsql --no-default-features --test e2e_approval_traces
• cargo test --features libsql --no-default-features --test e2e_auth_gate_traces
• cargo test --features libsql --no-default-features --test e2e_gateway_trace_harness
• cargo test --features libsql --no-default-features --lib handle_with_engine_text_auth_fallback_
• cargo fmt --check
• cargo clippy --features libsql --no-default-features --lib --test e2e_approval_traces --test e2e_auth_gate_traces --test e2e_gateway_trace_harness

[gemini-code-assist]

Code Review

This pull request introduces comprehensive end-to-end testing for approval workflows and authentication gates. Key additions include a TraceRunner harness for replaying tool sequences, numerous test fixtures for LLM and gateway traces, and integration tests covering various auth and approval scenarios. The ToolRegistry was updated with a test-only method to override protected tools, and the test rig was enhanced with helpers for auth gate resolution. I have no feedback to provide.

[henrypark133]

What looks good:

• The new replay coverage is mostly caller-level and fixture-driven rather than helper-only, which is the right shape for approval/auth regressions.
• The gateway trace harness exercises the real Tool -> ActionRecord -> save_action path against a migrated libSQL test database.
• The new text-auth-fallback router tests cover both the positive registered-credential branch and the negative trust-check branches.

No verified findings.

Summary:

• Recommended verdict: Approve
• Prior feedback status: no prior review
• Review coverage: checked-out worktree plus harness/router/testing pass
• Residual risk: I did not run the full replay fixture matrix locally in this pass

[zmanian]

Reviewed the full diff. Strong PR overall — approving.

What works well:

• Router fallback tests test through the caller (handle_with_engine_inner), not just parse_credential_name. Positive, unregistered-credential, and invalid-name branches are all covered, matching the IronClaw rule that gating predicates need call-site regression coverage. The with_installed_engine_state panic-safe guard correctly restores ENGINE_STATE on unwind.
• Approval replay suite exercises actual side effects via AtomicUsize execution counters, not tautologies. always_requirement_ignores_allow_always_persistence is a load-bearing test — it pins the ApprovalRequirement::Always hard floor against a real foot-gun. bare_yes_with_no_pending_approval_is_user_input correctly inspects captured LLM requests to prove the routing downgrade.
• Auth-gate tests use typed Submission::GateAuthResolution / ExternalCallback rather than string parsing, which is the right abstraction level.
• TraceRunner correctly creates the parent agent_jobs row to satisfy the job_actions FK, separates TraceResult.failures (assertion-level) from ActionRecord.success (tool-level), and the determinism test strips only the documented variable fields (id, executed_at, duration).
• Fixture README clearly differentiates llm_traces/ vs gateway_traces/ intent and documents deferred work (#640 settings CRUD, extension lifecycle).

Minor notes (non-blocking):

• wait_for_approval_needed polls every 50ms up to 15s. Under a loaded CI runner this should be fine, but if these ever get flaky bump the deadline rather than the poll interval.
• unknown_tool_fails.json expects substring \"tool not registered\" while assertion_mix.json uses \"not registered\". Both match the runner's actual message (\"tool not registered: {name}\"), but pick one convention for consistency.
• TraceExpectation::Success.assertions silently accepts unknown top-level keys as failures (good) but the fields dot-path walker can't express keys that contain a literal dot. Not a problem for current fixtures; worth a comment if you extend the DSL.
• CompletedTextLlm and NeedsApprovalProbe/AlwaysApprovalProbe have near-identical shapes; a small shared helper could de-duplicate, but duplication in tests is fine.

No blocking issues. Scope is tight, coverage is meaningful, no prod-side unwraps added.