refactor(config): adopt api/pkg/agentconfig as the declared config

[ccf-lisa]

Part 3/11 of the split of #95 (agent remote configuration) into a stack. Review it as the diff against its base branch.

The config file is decoded into agentconfig.Config (the declared form) and
validated with the shared rules, then converted once by toRuntime into the
existing runtime structs, so agentConfigurationHash and evidence identity
stay byte-identical (the golden test from the previous commit proves it).

• loadBase builds a fresh viper per load with viper's weak decoder, exactly
  as before (R51); CLI flags and the CCF_API_AUTH_* bindings are unchanged.
• File problems that always loaded stay non-fatal (R34): a bad plugin
  schedule skips that plugin, a negative verbosity or a literal ${env:...}
  outside plugins.*.config is a warning. Everything else is still fatal.
• Plugins gain enabled (default true); a disabled plugin gets no cron,
  download or run state.
• IsOCI delegates to agentconfig.IsOCISource so agent and API classify
  sources the same way.
• Pin compliance-framework/api b53be8f for pkg/agentconfig.

Size: 919 lines changed (go.mod/go.sum excluded). Builds, vets, is gofmt-clean and passes go test -race ./... on its own; the top of the stack is byte-identical to #95 merged with main.

Stack

1. test: pin agent configuration hashes and evidence seeds #101 test: pin agent configuration hashes and evidence seeds
2. feat(runner): policy source from the _policy_path label; extra evidence props #102 feat(runner): policy source from the _policy_path label; extra evidence props
3. 👉 refactor(config): adopt api/pkg/agentconfig as the declared config #103 refactor(config): adopt api/pkg/agentconfig as the declared config
4. feat(agent): stable instance ID and per-instance state directory #104 feat(agent): stable instance ID and per-instance state directory
5. feat(agent): AgentRunner primitives for prepare-then-cancel reloads #105 feat(agent): AgentRunner primitives for prepare-then-cancel reloads
6. feat(agent): prepare-then-cancel config file reloads #106 feat(agent): prepare-then-cancel config file reloads
7. feat(pluginlib): read the agent library version a plugin binary was built with #107 feat(pluginlib): read the agent library version a plugin binary was built with
8. feat(agent): report the configuration to the API (remote_config off/report) #108 feat(agent): report the configuration to the API (remote_config off/report)
9. feat(agentstate): persisted cache for the remote configuration overlay #109 feat(agentstate): persisted cache for the remote configuration overlay
10. feat(agent): pull and apply remote configuration overlays (apply_safe/apply_all) #110 feat(agent): pull and apply remote configuration overlays (apply_safe/apply_all)
11. feat(config): ${env:NAME} placeholders in plugin config; ADR 0003 #111 feat(config): ${env:NAME} placeholders in plugin config; ADR 0003

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b0b08454-fc11-4a6e-abcd-cc9c147bb120

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

ccf-review: APPROVE

no findings.

Stack (gh stack 112): #101 → #102 → #103 → #104 → #105 → #106 → #107 → #108 → #109 → #110 → #111

[ccf-lisa]

PR approved. Marking ready for e2e.