Move agent management into Mission Control

[Codename-11]

What changed

• moves global agent profile and fleet management into Mission Control at /agents
• adds profile detail management for identity, runtime, MCP client rollups, workspace binding/unbinding, recent work, and safe archive/removal
• keeps workspace settings policy-only and Instance Admin governance-only
• preserves former Agent Studio URLs as redirects
• adds workspace authorization, durable audit events, updated docs, and lifecycle/browser coverage

Why

Agent configuration was split across Agent Studio, Workspace Settings, Mission Control, and Instance Admin without a clear ownership model. Mission Control is now the primary control plane: define, bind, and operate there; configure workspace policy in the workspace; govern the instance in Instance Admin.

Validation

• pnpm lint (exit 0; existing warnings only)
• pnpm typecheck
• full Vitest: 1,320 passed, 1 intentional live-connector skip
• production Next.js build
• focused Playwright lifecycle: 2/2
• affected mobile + multi-workspace Playwright: 13/13
• full serial Playwright: 47/47

No schema or migration changes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff7e06a7f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep workspace admins able to unbind private agents

When a bound agent's profile is private and owned by someone else (for example, the owner left/demoted or an instance admin bound a private profile), this link sends workspace admins to /agents/${agent.profile.id}, but agents.profiles.get rejects callers unless they own the profile, are instance admins, or the profile is instance-shared. Since this patch also removes the workspace-row Unbind action, a workspace OWNER/ADMIN who can still edit policy here can no longer unbind that active binding; keep an unbind affordance here or make Mission Control include profiles bound to workspaces the caller administers.

Useful? React with 👍 / 👎.