feat(cli): label OpenAI Agents SDK adapters stable

[Baziar]

Summary

• Adds enterprise-grade OpenAI Agents SDK adapters for Python 0.22.2 and TypeScript @openai/agents 0.18.0, and labels both Workspai adapters stable.
• Admits all four published agent kits through the reviewed release-admissions.v2.json inventory:
  • Microsoft Agent Framework · Python
  • Microsoft Agent Framework · .NET
  • OpenAI Agents SDK · Python
  • OpenAI Agents SDK · TypeScript
• Keeps Create and Attach fail-closed unless callers explicitly trust the reviewed release inventory and the adapter version, manifest, framework baseline, runtime, and platform matrix still match.
• Retains per-platform semantic implementation digests as qualification and audit provenance, without using them as runtime authorization locks. Routine implementation changes therefore do not require manually rebinding admission digests.
• Introduces risk-based Agent Framework CI:
  • Pull requests run Linux conformance only for the affected Microsoft or OpenAI adapter family.
  • Shared Agent Framework changes select both families.
  • Documentation-only changes do not trigger the specialized adapter workflow.
  • The complete twelve-lane Linux/macOS/Windows matrix remains available through manual qualification_mode: full for release qualification and admission-candidate generation.
• Makes all four agent kits consistently visible in interactive Create while keeping kit visibility separate from permission to scaffold.
• Hardens generated starters and lifecycle behavior:
  • Resolves canonical Workspai context from the owning agents/<instance> project rather than process cwd.
  • Enforces containment, regular-file checks, schema validation, and a 128 KiB context limit.
  • Preserves operational context files during generated tests.
  • Uses credentialless official test doubles for OpenAI lifecycle verification.
  • Aligns Microsoft Python and .NET context loading with the same ownership boundary.
  • Keeps dependency installation, credentials, generated-code execution, and model calls outside Create.
• Updates CLI versioning and release documentation for 0.76.0, dated September 20, 2026.
• Microsoft adapters remain preview; the .NET starter still pins the preview Microsoft.Agents.AI.Foundry package. OpenAI adapter stability does not imply support for handoffs, MCP, sessions, voice, sandbox orchestration, or approval loops.

Verification

• GitHub checks are green for the final PR SHA, including:
  • Linux, macOS, and Windows Build & Test
  • Linux, macOS, and Windows Workspace E2E
  • Windows Bridge E2E
  • Security Gate and CodeQL
  • Official Generator Smoke
  • Agent Framework affected-family Linux conformance
  • Final CI Gate
• Local full coverage:
  • 261 test files passed
  • 3,005 tests passed
  • 11 contractually skipped
• Typecheck, lint, formatting, generated-contract validation, and build pass.
• Enterprise packed-package smoke passes:
  • 445 package files verified
  • Five npm-backed Create scenarios
  • All four governed Agent Framework Create scenarios
  • Two offline fallback Create scenarios
• Interactive Create publishes all four agent kits.
• Reviewed release admission allows governed Create and Attach for all four adapters.
• A registry that does not explicitly trust reviewed release admissions remains blocked.
• Implementation-only changes alter the provenance digest without invalidating runtime admission.
• Changes to adapter version or manifest still fail closed.

Release boundary

The skipped Admit complete adapter matrix job on this pull request is expected. Under the risk-based workflow, admission-candidate generation runs only during an explicit manual execution with qualification_mode: full.

Before publishing workspai@0.76.0, run the full Agent Framework qualification matrix against the final main release SHA and complete the normal npm release gates.

This PR does not claim production-complete coverage for every OpenAI Agents SDK capability and does not promote Microsoft Agent Framework .NET to stable.