fix(agent): nested agent start loses assigned name — list/send fall back to folder-PID identity #402

Summary

ai-devkit agent start executed from inside a sandboxed/nested context (e.g. a lead agent's sandboxed shell) reports success with the assigned name but the entry is invisible to agent list/agent send, which instead see a synthesized fallback identity {cwd-folder}-{pid} (e.g. slug-lib-75800).

Repro (deterministic, any harness)

HOME=/tmp/fakehome ai-devkit agent start --type pi --name tests --cwd .../slug-lib
# → ✔ Agent "tests" started (PID 1769863); Attach: tmux attach -t tests

ai-devkit agent list    # from the real HOME
# → slug-lib-1769863    ← {cwd-folder}-{pid} fallback — the reported identity
#   send --id tests → No agent found

Terminal-started agents keep their names; only sandboxed callers with a divergent filesystem view lose them.

Root cause (code-verified)

agent start does not use the daemon. The path is:

start.command.ts → startAgent() [ManagedAgentRuntime.ts:89]
  → AgentRegistry.default() → DEFAULT_REGISTRY_PATH = os.homedir()/.ai-devkit/agents.json (+ SQLite)

The registry write resolves from the calling process's view — under a sandbox that is an overlay the daemon never sees (sandbox flavors either redirect HOME or overlay out-of-workspace writes). The daemon discovers only the process and synthesizes {folder}-{pid}. This is the last major legacy direct-write bypass of the sole-writer daemon architecture.

Fix direction (approved)

1. Route agent start through the daemon — new daemon RPC agent.start (type, name, cwd, mode): daemon-side validation (name regex, name-in-use, cwd exists), session creation, and registry write under the daemon's store. The CLI becomes a thin client with fast pre-checks. This covers both divergence flavors (HOME rewrite and write overlay) because the write happens inside the daemon's sane view.
2. Round-trip verification + loud failure — after start (both the daemon path and the legacy daemon-down fallback), verify the entry is visible to the identity authority before reporting success. On divergence, fail with a clear sandbox/divergent-environment diagnostic instead of a false ✔.
3. Autostart guard — never auto-spawn a daemon from a divergent/sandboxed environment; error loudly with guidance.

Deferred (phase 2, only if reported in the wild): HOME-independent socket resolution chain (XDG_RUNTIME_DIR → /tmp/ai-devkit-$UID → legacy). Normal machines have one HOME and one socket; the chain only matters for sandboxes that rewrite HOME specifically.

Related: #400 (send --wait no-session failure) occurs in the same nested-dispatch flow and composes with this fix.

Acceptance criteria

• Sandboxed/nested agent start either succeeds with the assigned name visible to list/send, or fails loudly with a divergent-environment diagnostic — never a silent fallback identity
• No false success in any mode, including the daemon-down fallback path
• No daemon auto-spawn from divergent environments
• e2e regression covering the fake-HOME sequence (succeed-via-daemon or fail-loud, never folder-PID)