feat: per-program status, opt-in reconcile tick, llmGateway.whenProxyUnavailable

[LutzLange]

Part of #86. Replaces #136, #137 and #138 as one PR on main (they were stacked on #135, now merged). The review on #137 and #138 is addressed in the commits fix(agent): tick reports the revision ... and fix(agent): failClosed says whether anything is in place ...; the earlier threads are answered on those PRs.

Why

• The controller sees only "applied" or "failed" per device, not which program was applied, which is in conflict, or which was skipped because the local proxy is down.
• Between configuration pushes, a deleted or hand-edited managed file, or a loosened file mode, stays wrong until the next push or restart.
• While the daemon runs without its proxy, the programs behind it removed their entries. For VS Code on GitHub's models that sends Copilot Chat straight to GitHub, past the gateway.

Change

Per-program status

• Each apply reports every managed program's outcome with a detail: applied, unchanged, removed, conflict, failed, and two new ones: inactive (the program uses the gateway but the proxy isn't running) and blocked (not applied because another program conflicted or failed).
• The daemon logs one line per program that wasn't applied and sends the list with its ConfigStatus; the controller stores the latest list per device, returns it in GET /api/v1/devices/{id} and shows a "Managed programs" card.

Opt-in reconcile tick

• daemon.reconcileInterval (local startup setting, off when unset, at most 30 days) re-applies the current configuration. A push, the startup apply and a tick never overlap; a tick reports the revision it applied, and only when its outcome changed.
• An apply no longer rewrites a file that already holds the planned bytes and grants no permission bit beyond the planned mode; a file with a looser mode is rewritten at the planned mode, for every program that writes a managed file.

llmGateway.whenProxyUnavailable for programs.copilot and programs.vscode

• failClosed (default) leaves the managed entries in place, so the tools fail instead of bypassing the gateway; when nothing of the daemon's is in place yet, the status says so and the tool keeps its own settings.
• failOpen removes the entries until the proxy is back; without a sidecar, entries carrying a pairing header are removed while the daemon has no pairing of its own.
• The controller's configuration view has a "Fail open without the local proxy" toggle. examples/copilot/ adds Dex, agentgateway, a daemon config and a step-by-step guide, plus github-side.md (what the GitHub organisation owner sets).

Risk and compatibility

• Upgrade the controller first: migration 0003 (device_program_status) is one-way, and older controllers and daemons reject whenProxyUnavailable. The proto fields programs and programs_reported are additive.
• Behaviour change for every program: identical writes are skipped, and a looser mode on a managed file is tightened on the next apply.
• A tick overrides local edits, which is why it's opt-in.

How to review

Five commits, one per part plus the review fixes:

1. per-program status: reconcile/mod.rs, reconcile/plan.rs, controller/src/database.rs + migration, DeviceView.tsx;
2. reconcile tick: tick.rs, remote.rs, the apply lock in reconcile/mod.rs, the identical-write skip in reconcile/plan.rs;
3. review fixes for the tick (revision under the lock, mode repair in all planners, schema);
4. whenProxyUnavailable: fail_closed_without_proxy in reconcile/mod.rs and the three planners, the toggle in ConfigurationView.tsx, the example;
5. review fixes for the policy (in-place reasons, failOpen reason, cleanup without a sidecar).

Tests

Unit tests cover outcome precedence and reporting, controller storage, the tick (dedup, lock ordering, logout, revision), mode repair per program, and both policies in the three planners; Storybook stories cover the card and the toggle. Lab-tested on a Linux VM: the device page shows each program's outcome; with a 20 s interval a deleted file is back and a loosened mode is tightened within one interval, quiet ticks write nothing; both failClosed reasons, failOpen on all three files, and cleanup without sidecars. With a Copilot Business seat, VS Code on GitHub's models answers through the proxy, and with the proxy off under failClosed the chat fails with the requests refused at the loopback port, no fallback to GitHub. The guide's steps 1 to 4 and 6 were run from the guide alone.

Follow-ups

• The startup apply's outcome is not reported to the controller: Startup-apply outcome not reported to the controller; outcome lines logged twice per restart LutzLange/agentdesktop#26.
• A controller-delivered reconcile interval: Controller-delivered reconcile interval LutzLange/agentdesktop#27.

🤖 Generated with Claude Code

[peterj]

@LutzLange there are some test/lint failures -- can you take a look?