feat(adapters): multi-agent support via ACP preset registry

[caoergou]

Implements phases 1–3 of #50: owloop now supports Claude Code, Codex, OpenCode, Qoder, Kimi, GLM, DeepSeek, Kiro (and Gemini/Qwen for free) through a single protocol-level integration.

Rebased onto #52 (Phase 1 trust & safety core): the ACP path composes cleanly with the new engine-owned verification gate — the agent signals DONE over ACP, then the engine runs the acceptance criteria itself and owns commit/push.

What changed

src/owloop/presets.py — agent preset registry (Phase 1)

• AgentPreset dataclass: launch command, extra env (${VAR} references resolved from the user's environment at spawn time, {model} placeholder), worktree config dirs, experimental flag — per-tool knowledge is pure data, never code
• 11 builtin presets; user-defined presets via .owloop/agents.toml (can also override builtins)

src/owloop/acp.py — one AcpAdapter for all non-native agents (Phase 2)

• Minimal hand-rolled ACP client (JSON-RPC 2.0 over stdio): initialize → session/new → session/prompt, one fresh process + session per iteration (preserves fresh-context-per-iteration)
• Streams session/update into the existing on_line display conventions; usage_update → TokenTracker; stopReason decides success
• Answers session/request_permission itself, preferring allow_once — agents are never launched in bypass/YOLO modes ("Auto Mode, not YOLO" now enforced by the harness, not just hoped for)
• No new dependencies: the protocol subset a loop client needs is small, and the official SDK is asyncio/Pydantic-based while owloop's adapter interface is synchronous

Presets (Phase 3)

• ACP: claude-acp, codex, opencode, qoder, kiro, gemini, qwen
• glm / deepseek: their officially documented path is an Anthropic-compatible endpoint, so both ride the Claude ACP adapter with ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN/model env — zero extra code (GLM: api.z.ai/api/anthropic, model glm-5.2; DeepSeek: api.deepseek.com/anthropic, model deepseek-v4-pro — deliberately not the deprecated deepseek-chat/deepseek-reasoner)
• Presets not yet validated against the real agent are labeled experimental in owloop agents output

Wiring

• get_adapter() resolves through the registry; claude/kimi keep their native stream-json adapters unchanged (including feat(engine): Phase 1 trust & safety core — enforced verification, terminal states, rollback (#37) #52's max_turns/max_budget_usd passthrough)
• --agent accepts any preset key (builtin or user-defined); new owloop agents command shows readiness (binary found, missing env vars, experimental)
• OwloopEngine.setup_worktree() copies adapter-declared config dirs (e.g. .qoder/) in addition to .claude/

Testing

• tests/fake_acp_agent.py: scripted fake ACP agent run as a real subprocess — deterministic, no network. Scenarios: full happy turn, permission round-trip (the fake agent only emits DONE if the client selected the allow_once option, proving the auto-answer policy), refusal, hang → idle timeout, crash → stderr-tail diagnostics, missing binary, missing env var
• tests/test_presets.py: registry coverage of all requested agents, env expansion, model placeholder, official endpoint/model assertions for GLM/DeepSeek, agents.toml load/override
• 305 tests pass; ruff and mypy clean
• Manual end-to-end (post-rebase): temp git repo + agents.toml custom preset + owloop run --agent faketool --no-tui -n 1 completes a full iteration — ACP streaming, DONE promise, engine verification gate passes, engine commits owloop: complete 01-demo.md, terminal state success

Closes #50 (phases 1–3; phase 4 — flipping claude/kimi defaults to ACP — deferred per the issue).