feat(projections): add provider-neutral agent adapters

[szmyty]

Summary

• define aether.projection-interface/v1 with a versioned provider registry and JSON Schema
• preserve existing GitHub Copilot agent projection paths while making the legacy builder a compatibility entrypoint
• add deterministic native project projections for Claude Code and OpenCode
• register VS Code as a native consumer of the shared .github/agents output rather than duplicating files
• emit an explicit Zencoder manual-import packet instead of inventing an undocumented repository-native format
• add a secret-free local Docker template for the official GitHub MCP Server
• emit per-agent provenance headers plus a deterministic projection manifest with output/source hashes
• correct AET-04 dependency direction so Empathy spec(distribution): extend release declarations with distribution targets, package coordinates, and publisher bindings #63 consumes Aether rather than blocking it
• repair two pre-existing Aether validation defects exposed while restoring the full PR pipeline

Architecture

library/organization/agents/<id>/AGENT.md
        ↓ canonical intent
Aether projection interface v1
        ├── GitHub Copilot / VS Code -> .github/agents/
        ├── Claude Code              -> .claude/agents/
        ├── OpenCode                 -> .opencode/agents/
        ├── Zencoder                 -> explicit manual-import packet
        └── GitHub MCP               -> secret-free template
        ↓
released generated distribution
        ↓
Empathy / Holon / consumer repositories

Provider formats remain generated adapters. Aether source is canonical; Empathy owns downstream integration profiles and Holon may materialize pinned Aether releases.

Authority and safety

• provider projections cannot silently gain canonical tool authority
• Claude Code receives an explicit translated tool allowlist
• OpenCode starts from wildcard deny and selectively enables translated tools/skills
• Zencoder remains manual-import until a repository-native custom-agent format is verified
• the MCP template contains no token value and forwards only the environment variable name
• generated output is timestamp-free and records canonical SHA-256 source provenance

Compatibility

The existing entrypoint remains valid:

python3 library/organization/agents/build-projections.py \
  --output-directory "dist"

It delegates to the provider-neutral implementation while preserving the legacy AGENTS_DIR override used by existing release tests. Existing ./aether distribution build and release validation therefore exercise every projection adapter without changing their command surface.

Baseline repairs uncovered by CI

Aether's default branch was already failing PR validation before this work. Advancing #39 through the complete pipeline exposed two inherited defects that are repaired here rather than bypassed:

1. First-party catalog drift from PR Define the architecture materialization contract #42 — architecture/document.spec.md had a stale digest and the new architecture/set.spec.md was missing from catalog.v1.json. The catalog is regenerated from Aether's canonical generator.
2. Provenance schema resolution from PR Finalize artifact lifecycle and provenance model #43 — the provenance schema used a relative pseudo-URI $id, causing its local fragment references to resolve as an invalid remote URL. The schema now uses Aether's absolute https://egohygiene.io/schemas/... namespace with a regression test.

These are baseline synchronization/validation repairs; they do not broaden the provider-projection architecture.

Validation

Added focused tests for:

• provider registry/schema states
• legacy GitHub path compatibility
• Claude/OpenCode tool translation
• deny-by-default OpenCode permissions
• Zencoder manual-import behavior
• secret-free GitHub MCP configuration
• projection provenance
• deterministic two-build output
• drift detection
• manifest hashes/provider states
• absolute provenance schema identity

The complete Aether PR workflow is green:

• distribution build and drift check
• full Aether validation and strict staging validation
• first-party catalog generation/check
• schema/catalog validation
• normalized provenance validation
• 146 deterministic eval cases
• complete Python test suite, including legacy projection compatibility
• two-build distribution reproducibility
• gh skill publish "dist" --dry-run

Closes #39

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress