feat(agent): pull and apply remote configuration overlays (apply_safe/apply_all)

[ccf-lisa]

Part 10/11 of the split of #95 (agent remote configuration) into a stack. Review it as the diff against its base branch.

With remote_config.mode apply_safe or apply_all the reconciler polls the API
for the configuration overlay and applies it on top of the file:

• Fetch every poll_interval (±10%) with the cached raw ETag as
  If-None-Match; a 304 keeps the cached overlay, and the API's error table
  applies to fetches as to reports (R7, R8).
• prepare decodes the overlay strictly (unknown keys and non-string values
  reject it, R27), runs the agentconfig Classify + WillApply gate against
  the agent's own base and remote_config before anything touches the
  network, merges it (RFC 7396) and validates the result. Errors at
  pointers the overlay touched are strict; file-origin ones keep the R34
  tolerance.
• A rejected revision is remembered per (ETag, base fingerprint), or per
  revision + overlay hash without an ETag, with its reason, error and
  unsafe changes; it is not re-prepared every poll, is re-reported after a
  restart, and a base change re-classifies it. A failed revision (download,
  run) is retried with the failed backoff.
• Startup tries the fetched overlay, then the cached applied one, then the
  file alone. A no-op revision is recorded as applied without a restart.
• Reports carry the applied and attempted revisions and the unsafe
  changes; evidence produced under an overlay carries the
  agent-config-revision prop (R38).

${env:NAME} placeholders in plugin config are resolved in the next PR;
until then they reach plugins unchanged, as on main.

size-exception: 1417 LOC, of which ~780 are tests (cmd/remote_test.go, 700 lines). The production code is ~640 LOC; the overlay cache was already split out into #109.

Size: 1417 lines changed (go.mod/go.sum excluded). Builds, vets, is gofmt-clean and passes go test -race ./... on its own; the top of the stack is byte-identical to #95 merged with main.

Stack

1. test: pin agent configuration hashes and evidence seeds #101 test: pin agent configuration hashes and evidence seeds
2. feat(runner): policy source from the _policy_path label; extra evidence props #102 feat(runner): policy source from the _policy_path label; extra evidence props
3. refactor(config): adopt api/pkg/agentconfig as the declared config #103 refactor(config): adopt api/pkg/agentconfig as the declared config
4. feat(agent): stable instance ID and per-instance state directory #104 feat(agent): stable instance ID and per-instance state directory
5. feat(agent): AgentRunner primitives for prepare-then-cancel reloads #105 feat(agent): AgentRunner primitives for prepare-then-cancel reloads
6. feat(agent): prepare-then-cancel config file reloads #106 feat(agent): prepare-then-cancel config file reloads
7. feat(pluginlib): read the agent library version a plugin binary was built with #107 feat(pluginlib): read the agent library version a plugin binary was built with
8. feat(agent): report the configuration to the API (remote_config off/report) #108 feat(agent): report the configuration to the API (remote_config off/report)
9. feat(agentstate): persisted cache for the remote configuration overlay #109 feat(agentstate): persisted cache for the remote configuration overlay
10. 👉 feat(agent): pull and apply remote configuration overlays (apply_safe/apply_all) #110 feat(agent): pull and apply remote configuration overlays (apply_safe/apply_all)
11. feat(config): ${env:NAME} placeholders in plugin config; ADR 0003 #111 feat(config): ${env:NAME} placeholders in plugin config; ADR 0003

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f0c1ef8c-a2d3-4167-84f0-43aecfe27639

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

ccf-review: APPROVE

no findings.

Stack (gh stack 112): #101 → #102 → #103 → #104 → #105 → #106 → #107 → #108 → #109 → #110 → #111

Fixed later in the stack

• CORE-DOC-001 in docs/configuration.md: fixed in #102

[ccf-lisa]

PR approved. Marking ready for e2e.