feat(agent): runtime data_paths with portable export/import (#1169)

[AndriiPasternak31]

Summary

Implements #1169 (PR1): declared agent runtime data under data/ on the already-durable home volume — no separate volume, no platform schema change. Snapshots are filesystem artifacts; audit rides audit_log.

/home/developer is already a persistent named Docker volume (agent-{name}-workspace) that survives recreate/upgrade/template-repull/sub-switch, so data under /home/developer/data is already durable. This PR adds only the declaration + export/import surface.

What's included

• Declaration — template.yaml data_paths: (globs under data/) surfaced by template_service (github + local builders) and materialized at creation by crud.py → git_service.materialize_data_paths(): writes ~/.trinity/data-paths.yaml (quoted heredoc, glob-safe) and appends data/ + each declared path to the agent's own .gitignore (idempotent grep -qxF). Opt-in — an empty list is a complete no-op.
• Shared primitive — S4 persistent-state and data_paths now share one extracted materialize_trinity_yaml_list / _read_trinity_yaml_list (heredoc delimiter parameterized so persistent_state keeps PSTATE_EOF).
• Export — routers/agent_data.py POST /api/agents/{name}/data/export (owner/admin): streams container_get_archive("/home/developer/data") → temp under /data/agent-data-tmp → StreamingResponse; AGENT_DATA_EXPORT_MAX_BYTES (5 GiB) → 413; self-describing manifest.json in the tar; missing data/ → manifest-only tar (not 500); ?format=base64 for the MCP surface up to AGENT_DATA_INLINE_MAX_BYTES (10 MiB).
• Import — POST /api/agents/{name}/data/import (owner/admin): proxies to the agent-server restore_from_tar primitive (data/** allowlist + absolute/.. traversal rejection); Idempotency-Key (Invariant Unified Executions Dashboard (EXEC-022) #18). Both endpoints serialized per agent by a cross-worker Redis op lock (agent:data_op:{name}, fail-open, 409 on contention).
• MCP — export_agent_data / import_agent_data tools carry the base64 tar (Invariant feat: SMARTS trading pipeline with Telegram notifications and Miro visualization #13): "move an agent" = template URL + .credentials.enc + data tar.
• Validation — checks DP-001..DP-005 added to agent-validation-spec.md.
• Docs — architecture, requirements, feature-flows index + new agent-data-volumes flow, agent guide; CSO diff audit report (0 critical/high).

Testing

• ~30 unit + TestClient tests: export/import endpoints, data/** allowlist, gitignore append, template surface. Green locally (full sweep clean aside from pre-existing unrelated flakes).
• ⚠️ verify-local (real prod-image boot) was not run — blocked locally by a running sibling stack on the pinned agent/platform /16s. Worth a full verify-local pass before release to main.

Out of scope (deferred)

• PR2: scheduled snapshots + ~/.trinity/pre-snapshot SQLite-quiesce hook + retention + rename/purge snapshot-dir cascade.
• System agents.

Closes #1169

🤖 Generated with Claude Code

[github-actions]

⚠️ Nightly unit-suite check skipped — merge conflict against dev.

Resolve by running git merge dev locally and pushing the result. The next nightly run will re-test once the conflict is gone.

[vybe]

validate-pr: PASS (per your 'merge on validate-pr' decision) → dev. P1 feature (#1169, agent runtime data volumes, +2325). Security scan: no secrets/keys/emails. New router agent_data.py lives in routers/ (COPYed wholesale — no Dockerfile gap); endpoints documented in architecture.md + requirements.md + feature-flows. Packaging: ⚠️ non-blocking — AGENT_DATA_EXPORT_MAX_BYTES/INLINE_MAX_BYTES/OP_LOCK_TTL are os.getenv tunables with safe defaults (5GB/10MB/1800s), so the feature works on defaults; not wired to .env.example (follow-up, not a blocker). Resolved doc conflicts with #1297/#1293. All required checks were green pre-rebase. Approving.