Add live transcript attach and managed agent runs

[Stephen Belanger (Qard)]

Summary

• add live transcript attach and managed agent runs for Codex and Claude
• inject invocation-local hooks while preserving normal Codex hook trust
• isolate each managed run with a complete non-secret invocation selection instead of inheriting or rewriting persistent setup settings
• keep profile selection optional; an omitted profile resolves through the daemon host's default
• support project, typed object destination, and parent-span destination selection
• reject a managed run without a destination before launching the coding agent

Route initialization contract

bt trace setup persists the selected non-secret SessionRoute in the shared hook settings file. Existing agent sessions continue to use that setup route.

bt trace run selects a route interactively or from flags and supplies traceToBraintrust: true plus that immutable route through BT_TRACE_INVOCATION_SETTINGS to only the launched process tree. Its generated hook command remains identical to the setup hook. Concurrent managed runs can therefore use different profiles, organizations, projects, experiments, or parent spans without changing setup or one another.

Hooks pass only profile, organization, and destination selection. The daemon host resolves and refreshes credentials. Malformed invocation settings fail closed for tracing instead of falling back to the persistent route.

Validation

• cargo test --manifest-path bt-daemon/Cargo.toml --all-features --locked
• cargo clippy --manifest-path bt-daemon/Cargo.toml --all-targets --all-features --locked -- -D warnings
• cargo fmt --manifest-path bt-daemon/Cargo.toml --check
• git diff --check
• rebased OpenCode branch: make validate-opencode
• rebased Pi branch: make validate-pi

Release impact

No package is published, no marketplace repository is deployed, and no tag or GitHub release is created.