Make Comet local-first with optional multi-device sync

[jsgrrchg]

I tested this extensively on macOS, but I haven't been able to test it on Linux or Windows since I don't currently have environments set up for those platforms.

Please review this carefully, as these changes affect important parts of the app. I've also extended the E2E tests to improve macOS coverage.

Feel free to request any changes. I'll keep an eye out for feedback and address anything that comes up.

Closes #3

-- The following is AI-- :

Summary

• Make a clean Comet installation fully usable without an account or network connection.
• Turn multi-device sync into an explicit opt-in while keeping local and synced workspace data isolated.
• Harden authentication and runtime transitions so changing accounts never swaps storage or transports underneath a running engine.

What changed

Local-first engine profiles

• Introduce immutable Local, Synced, and Development workspace scopes, resolve the active profile once at startup, and expose it through the new EngineInfo RPC.
• Store local snapshots, run journals, and uploads under profiles/local/ with a stable installation-local identity.
• Preserve the existing orgs/{org_id}/{user_id} layout for authenticated profiles, so current synced installations reopen their existing data in place.
• Keep Edge rooms, relays, and uploads disabled for local profiles. Development mode also stays offline unless an explicit bearer is configured.
• Keep device-scoped resources such as repositories, worktrees, agent credentials, settings, and device identity available across profiles without exposing transcripts or attachments from another profile.

Authentication and lifecycle

• Make comet headless and the Linux installer start immediately in local-only mode; signing in is no longer required to run the daemon.
• Make comet login and comet logout select the profile for the next engine start, while refusing to mutate credentials behind a running engine.
• Report the live runtime scope in comet status, with signed-out local mode treated as healthy.
• Add graceful engine shutdown over RPC and SIGTERM so desktop/daemon transitions drain state and release IPC before a replacement runtime starts.
• Fence canceled OAuth exchanges so an in-flight callback cannot restore credentials after sign-out, and back off transient offline refresh failures without treating them as revocation.
• Publish device and local-profile identities atomically and recover an empty legacy device identity safely.

Desktop experience

• Replace the signed-out account gate with a ready local workspace and an optional Enable sync action.
• Keep the current local workspace open throughout sign-in and require a restart before entering the synced profile; local sessions are never uploaded implicitly.
• Coordinate pending sync/restart state across viewports, block every synced viewport after sign-out, and wait for a remote daemon to stop before quitting for a profile change.
• Treat older daemons without EngineInfo as synced so they retain the previous authentication gate instead of being mistaken for local runtimes.

Tests and documentation

• Add integration coverage for signed-out startup, offline transport behavior, profile persistence and isolation, attachment jails, legacy synced-layout reuse, auth changes during a local runtime, and graceful daemon shutdown.
• Update the two-device smoke driver to materialize transcript reset/delta frames and make Worker process-group cleanup work on macOS and Linux.
• Document local-first installation, optional sync, profile storage boundaries, privacy guarantees, and the intentionally deferred cross-profile import/switching work.

Upgrade behavior

• A clean installation starts in the local profile without contacting the Edge service.
• An installation with a valid saved WorkOS session continues to start in its existing synced profile and storage layout.
• Signing in does not upload, import, link, or delete local sessions or attachments.
• Signing out returns to the same local profile on the next start; switching profiles always requires an engine restart.

Testing

• cargo test --workspace --features comet-sync/mock-server -- --skip repos_round_trip_add_branches_worktrees --skip falls_back_when_interactive_attempt_hangs
• cargo test -p comet-rpc --example e2e_driver
• cargo clippy --workspace --all-targets --features comet-sync/mock-server
• scripts/e2e-smoke.sh
• git diff --check upstream/main...HEAD

The changes introduced by this branch pass Clippy. The workspace Clippy command exits successfully with only pre-existing warnings outside the modified hunks: collapsible_if in crates/update; four cloned_ref_to_slice_refs warnings in crates/doc; needless_return, two obfuscated_if_else warnings, and one unused test variable in crates/engine; and, in crates/ui, seven unexpected_cfgs warnings from the macOS Objective-C macros plus manual_is_multiple_of, collapsible_if, question_mark, unnecessary_sort_by, four doc_lazy_continuation warnings, three type_complexity warnings, too_many_arguments, and len_without_is_empty. Running Clippy with -D warnings therefore stops at the first unchanged collapsible_if warning in crates/update/src/lib.rs. The workspace test command skips two unchanged baseline tests on macOS: one compares /var/... with its canonical /private/var/... path, and one is an existing interactive-shell timeout flake. cargo fmt --all -- --check currently reports only pre-existing formatting drift in unchanged crates/sync/src/room.rs, which is identical to upstream/main.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}