Add an Atomic SDK harness for the hosted Planner

HARNESS=atomic embeds Atomic 0.9.23 in the server process through its
headless SDK (createAgentSession, ModelRuntime, DefaultResourceLoader,
and in-memory session and settings managers). It does not spawn the
atomic CLI, use RPC mode, or alias Pi's runtime.

Each harness session owns one Atomic AgentSession in a private temporary
directory. Every shipped Atomic package is off, the tool allowlist holds
only the host tools and a result tool, and the loader discovers no
extensions, skills, prompt templates, or context files. A per-turn hook
replaces the whole system prompt, so the model never sees Atomic's
coding-agent preamble. The adapter fails the turn before any model
request if the live session reports an extra extension, tool, context
file, skill, prompt template, or system prompt. It checks the tools
offered to the model again before every model request.

Host tools round-trip through submitToolResult and settle on abort.
Structured output uses a terminating result tool enabled only from the
turn's JSON response format, which captures the calling model's
arguments without a second inference. An unrecognized provider/model
fails the turn instead of letting Atomic pick another model, and MODEL
is now required for HARNESS=atomic as it is for Pi.

HARNESS_AUTH is required and is either auto or ai-gateway. auto copies
the host's Atomic login into memory and is refused off loopback;
ai-gateway accepts only vercel-ai-gateway models. Credentials are never
written to disk. The Pi auth checks now share the same table with
unchanged messages.

Docs cover selection, trust, credentials, and Atomic's caveats.

Assistant-workflow: ralph (run 0cfa5220-f488-43ef-8bb5-2f54cf5141f2)
Assistant-model: Claude Opus 5.5
Assistant-duration: 30m converged, estimated 65m
Assistant-verification: bun test passed: 1683 pass, 2 PostgreSQL skips, 0 fail, including the atomic contract suite and the unchanged copilot-sdk and pi suites
Assistant-verification: bun run types passed: all workspaces and E2E
Assistant-verification: bun run ci passed: dprint, oxlint with no errors, tokens
Assistant-verification: bun run fix passed: only formatting changes, inspected
Assistant-verification: mutation checks passed: turning builtins back on, enabling skill discovery, or offering the result tool on plain turns each fail the atomic suite
Assistant-verification: agent-browser E2E passed: a real Chopin server with HARNESS=atomic and a local stub model ran an @chopin turn that called read_plan and streamed the reply into Chat; the model was offered exactly PLANNER_TOOL_NAMES and Chopin's Planner prompt
Assistant-verification: qlty smells passed: no blocking findings; complexity warnings match the Copilot adapter's closure shape
User-preference: Build the Atomic harness on Atomic's headless SDK, which separates runtime from hosts
Co-authored-by: Alex Lavaee <lavaman131@github.com>