Rebuild Cortex CLI as the coding-agent harness on a current Cargo/CI base

[echobt]

Summary

Restarts the stale CortexLM/cortex-code coding-agent harness on CortexLM/cli.

Imported the public rust workspace (tarball of CortexLM/cortex-code @ 7954d02, last push 2026-07-26) as the starting tree, then modernized it:

• Product name is Cortex CLI / Cortex Code. Auth and Chat/Code turns go to api.cortex.foundation / auth.cortex.foundation (WorkOS session / existing /v1 auth).
• Workspace crate version 0.1.0, edition = "2024", rust-version = "1.98" (current stable), cargo update.
• License Apache-2.0.
• Engineering bar: AGENTS.md, .rules/ (security, errors, TUI, structure, docs, API, git, testing), and a PR template with a required attestation list.
• CI on GitHub-hosted runners: fmt, ./scripts/clippy.sh (-D warnings + rustc 1.98 style allowlist), cargo test --workspace, cargo audit, dedicated TUI/snapshot job. Required via the CI Success aggregator.
• version-bump.yml now patch-bumps and tags on merge to main (keeps the existing VERSION_CLI scheme). release.yml / publish-r2.yml still target software.cortex.foundation; secret names are documented in docs/CI_SECRETS.md. No secrets in the repo.
• Product-facing API-down copy is The coding service is temporarily unavailable. Headless TUI/snapshot tests added for login, error, and buffer surfaces.
• wasmtime 41 → 48 so cargo audit is clean (plugin ResourceLimiter API updated).

Test plan

• ./scripts/check-cli-version.sh
• cargo fmt --all -- --check
• ./scripts/clippy.sh
• cargo test --workspace
• cargo audit
• GitHub Actions CI Success on this PR (fmt, clippy, test, TUI, audit)

Attestation (required)

I attest that:

• Security reviewed — auth, exec/sandbox, path traversal, network egress, and secret handling in this diff were reviewed. No secrets, tokens, or keyring dumps are in the change. wasmtime was bumped to 48 to clear RUSTSEC plugin-runtime advisories.
• Product-facing errors — user-visible failures use Cortex product copy. API-down paths say The coding service is temporarily unavailable. No raw provider, SDK, or transport names.
• TUI verified — login modal, service-unavailable capture, and tui-buffer banner have headless snapshot tests. CI TUI job is green. Full TTY run of Cortex still depends on a live api.cortex.foundation session.
• Tests added — engine error tests plus TUI snapshots. cargo test --workspace passed locally and in CI. No mocks that report success.
• No secrets — no API keys, WorkOS secrets, R2/AWS credentials, or .env files are included.

Risk

• First merge to main will patch-bump via version-bump.yml and tag v0.1.1.
• Release publish to R2 still needs the existing Cloudflare secrets (R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, CLOUDFLARE_ACCOUNT_ID) if those accounts already exist — documented, not invented.
• Chat/Code turns still require the live Cortex API; this PR is the client harness, not a mock backend.
• Plugin WASM ABI is still the existing Cortex plugin contract; wasmtime 48 is the host runtime only.