feat: New Fleet wizard writes config.toml locally before S3 (studio#135)

[brettchien]

Summary

Closes the gap #134 flagged: the wizard generated config.toml server-side but never wrote it into the operator's local Config folder (#130), so the "Agent configs" view (#134) had nothing to show until something else populated the folder by hand.

Brett's explicit ordering, confirmed directly rather than guessed: "Wizard should write to local first, write to s3 if needed." That ordering can only actually be guaranteed inside the sidecar (oab-mcp) — provision_agent/provision_agent_k8s are what do the S3 upload, so writing the local copy there, before the upload, is a real sequencing guarantee. Having the console write a local copy after receiving the tool's response back (my own earlier #135 write-up's default assumption) would mean S3 had already happened first no matter what — the opposite of what was asked.

Change

• studio-cp: new write_local_agent_config() — <folder>/<name>/config.toml, written from generate_agent_config()'s raw output before inject_pre_seed_hook mutates a copy for the S3/bundle path (that hook wires in an S3 zip URI meaningless for a local reference copy — the local file is the clean, human-authored text, not an ECS/k8s-specific artifact). Both provision_agent and provision_agent_k8s gained a local_config_folder: Option<&str> parameter — write happens unconditionally whenever the caller passes one, and hard-fails the whole deploy on a write error rather than silently proceeding without the copy it promised (folder set = a real requirement per Brett's phrasing, not best-effort).
• oab-mcp: deploy_provision_agent's schema gained local_config_folder (optional).
• src-tauri: bridge command threads the new param through.
• console: deploy.ts reads the same oab-studio.configFolder localStorage key the Config-folder setting (feat(console,src-tauri): local "Config folder" setting (studio#128) #130) already uses and sends it along.

This also resolves the mechanism question #135's own write-up had left open (send config_toml text back to console vs. have the sidecar write directly) — the ordering requirement settles it on its own: only the sidecar-writes approach can guarantee local-before-S3, so no config.toml text (which could carry secret references, aws-sm://..., even if never raw values) needs to cross the Tauri IPC bridge back to the console at all.

Verification

• npm run typecheck clean, npm test 100/100 passing, npm run build succeeds.
• Rust side not locally compiled — same pre-existing aws-sdk-ec2 OOM limitation as every other Rust change this week.
• Worth Brett re-testing a New Fleet deploy with a Config folder set, confirming the local file lands before/regardless of the S3 step completing.

Ref #135.

🤖 Generated with Claude Code