feat(run): persistent agent identity via the agent config key and ONECLI_AGENT

[guyb1]

What

onecli run gains a persistent, machine-local agent identity. The agent resolves as:

1. --agent <identifier> flag (unchanged)
2. ONECLI_AGENT environment variable (new)
3. onecli config set agent <identifier> (new config key)
4. none set → the project's server-side default agent (unchanged)

• agent joins api-host and project as a config key, with the same input hardening the --agent flag already applies (pkg/validate.ResourceID) — on the flag, the env value, and at config set time.
• config get agent respects the full precedence chain, exactly like project.
• Help drift fixed: onecli help now lists run's --enforce flag (it was missing), and config get/config set name the valid keys.
• README documents the Run command, the config keys, and the previously undocumented ONECLI_PROJECT / new ONECLI_AGENT env vars.

Why

The dashboard's Install page can pin a machine to a specific agent (onecli-cloud#747). Until now that persistence had nowhere to live: --agent had to be retyped on every run, and the old install script's config set default-agent line targeted a key that never existed — it failed silently. This PR gives the pin a real home; the new install script calls onecli config set agent "$AGENT" and prints a loud fallback (onecli run --agent … -- <command>) on older CLI versions.

Release order: this should release before the onecli-cloud#747 deploy; onecli/onecli-docs#12 merges last so the script's pin line works from day one (the fallback covers any skew).

Verification

• go build ./..., go test ./..., go test -race ./... all green; golangci-lint run — 0 issues; gofmt -l clean; the hand-maintained help lockstep test passes.
• 12 new tests: config-key round-trip, env-over-file precedence, invalid-identifier rejection at config set, and the full resolveAgent matrix (flag > env > config file > empty; hardened-input rejection on flag and env).
• Live two-sided proof against the released 2.9.0 binary vs this build, in a sandboxed $HOME: the install script's exact pin line fails on 2.9.0 with {"error":"unknown config key: agent"} (the script's loud-fallback branch) and succeeds on this build; round-trip, env precedence, and invalid rejection all verified through the real binary; all output JSON.

Review

Self-review (hunk-by-hunk) + this repo's own skills walked in full: agent-first-cli (JSON-only stdout, boundary hardening on all three input paths, self-documenting help — clean), golang-patterns (mirrors the existing resolveProject idiom exactly; %w wrapping; documented exports — clean), golang-pro (MUST-list incl. -race, table-driven rejection tests — clean), plus a cross-repo contract check against the cloud PR (key name, env var, precedence, wire param — identical). Findings: none beyond implementation.

🤖 Generated with Claude Code