fix(agent): hide unsupported CodeBuddy goal control

[mt-hub8]

Summary

• remove the exact CodeBuddy goal + activateGoalMode mapping while resolving its effective Agent Extension composer profile
• keep the compatibility policy in the tuttid product adapter so shared AgentGUI and Agent Host remain provider-neutral
• cover the CodeBuddy match, other extensions, and a provider-owned CodeBuddy /goal effect with focused tests
• document the fail-closed extension-profile compatibility boundary

CodeBuddy currently advertises a provider-owned /goal command, while its signed composer profile maps that command to Tutti structured Goal control. The current CodeBuddy integration does not provide the end-to-end structured Goal lifecycle needed by that control, so exposing it in the panel can enter a flow that repeatedly fails. This change hides only that structured panel entry until the lifecycle is compatible.

This does not change Session, Turn, Goal, or runtime-operation lifecycle semantics. tsh and other Host consumers do not need this behavior; it is Tutti product policy for the CodeBuddy Agent Extension catalog.

Risk assessment

Overall risk is low:

• the rule requires the exact codebuddy installation key, normalized goal command name, and exact activateGoalMode effect
• other Agent Extensions and CodeBuddy commands such as compact, status, and plan are unchanged
• a future CodeBuddy goal entry with an ordinary provider-owned effect is preserved
• ACP transport, runtime launch, permissions, models, typed Goal APIs, and shared AgentGUI behavior are unchanged
• manually typing /goal is not intercepted; this change only narrows the projected panel catalog
• the current signed CodeBuddy profile keeps the catalog authoritative, so the omitted entry also filters the runtime-advertised command from the panel
• rollback is limited to removing the compatibility policy after CodeBuddy supports the structured lifecycle
• the change is platform-neutral string/list projection logic and has no Windows-specific impact

Verification

• go test . -run 'TestApplyAgentExtensionComposerCompatibilityPolicy' -count=1 from services/tuttid
• pnpm setup:worktree
• pnpm check:changed -- --base upstream/main — 5 lanes passed
• go build ./... from services/tuttid
• pre-commit formatting and staged boundary checks passed
• pre-push pnpm check:changed -- --push-ready — 6 lanes passed

Fallback Three Questions

• Source: the immutable signed CodeBuddy composer profile maps its provider-owned /goal command to Tutti activateGoalMode, but the integration does not yet provide a compatible structured Goal lifecycle.
• Why can it not be fixed at that source? Existing signed CodeBuddy releases are immutable and already installed. A future extension release alone cannot protect users of those supported versions, so Tutti must fail closed while resolving their effective presentation policy.
• Removal condition: delete this compatibility policy after every supported CodeBuddy extension/runtime combination either implements the Tutti structured Goal lifecycle or no longer declares the mapping, and older affected releases are no longer supported.

Checklist

• This PR does not change agent lifecycle semantics; it changes daemon-owned presentation/product policy only.
• I kept the change focused on one concern.
• I updated the Agent Extensions architecture documentation for the behavior and ownership boundary.
• No README or CONTRIBUTING source changed, so language-variant updates are not required.
• I ran the lowest meaningful local checks selected for the changed surface.
• The commit is signed off with DCO.