feat(desktop): node-advertised harness picker, capability-filtered Run-on, Nodes settings

[shivchander]

What

Eliminates three execution-node UX band-aids that made creating a node-hosted
agent painful (local adapter installs, CLI-only node approval) and could
crash-loop a node.

(a) Node-target harness picker uses the node's advertised runtimes

Previously the harness picker probed this Mac for adapters even when the
agent was going to run on a remote node, so you had to npm install -g
codex-acp / claude-agent-acp locally just to create a node agent.

Now, when the "Run on" target is a node, the picker offers the runtimes that
node advertises (labelled (on node)) — even if the adapter is missing
locally. The node runs the adapter, not the desktop.

• New pure helper runtimeAdapterCommand.ts:
  • adapterCommandForRuntimeId — runtime id → adapter command, mirroring the
    Rust KNOWN_ACP_RUNTIMES table (discovery.rs).
  • nodeAdvertisesRuntime — id match, treating the legacy "acp" id as a
    wildcard.
  • nodeRuntimeForCreate — synthesizes the AcpRuntime for a node target from
    the local catalog entry (discovery lists every known runtime regardless
    of local availability, so the entry exists even when the adapter isn't
    installed).
• Both create-gates (useAgentManagement.submitCreate,
  usePersonaActions.handleSubmit) resolve a node runtime instead of erroring.
• instanceInputForDefinition falls back to the adapter command when the local
  command is null.

(b) Re-add the "Nodes" entry to Settings

The execution-node approval panel lost its Settings nav entry after an upstream
merge (Settings → Compute is the unrelated mesh-LLM feature). Approving a
node was a CLI dance. Settings → Nodes is back (pubkey → Approve).

(c) Capability-filter the "Run on" picker

The picker now only offers nodes that can host the picked harness (legacy
"acp" advertisement = wildcard), with a warning when a prior node selection
stops matching after a harness change.

selectedRuntimeIsAvailable is now node-aware: on a node target only the
node's advertised runtimes count — local adapter availability is irrelevant.
This blocks a harness the node can't run at submit, not merely with a
warning, closing the path where a locally-installed adapter let an incompatible
node create through and crash-loop the node.

Notes

• AgentDefinitionDialog's provider/model dropdown builders were extracted to
  agentDialogDropdownOptions.ts (behavior-preserving) to stay under the
  file-size ratchet.

Testing

• biome, tsc --noEmit, check:px-text, and the differential file-size
  ratchet — all clean.
• Agents unit suite: 1541 pass (6 new for the helper).

Follow-ups (not in this PR)

• Restrict the runtime UI to codex + claude across all surfaces.
• Node-stack should auto-set the codex headless-auth env; daemon
  reboot-durability (autostart).

🤖 Generated with Claude Code