Add configurable multi-Oracle groups

[dsebban]

This adds configurable multi-Oracle groups across the macOS app, Context Builder, and direct headless MCP. A permanent Primary Oracle can be joined by up to four ordered additional Oracles; every lane receives the same frozen context and returns an independent, unsynthesized response.

Summary

• Adds an ordered Oracle roster: Primary plus zero to four additional Oracles, including intentional duplicate model choices.
• Runs Oracle lanes independently against the same request snapshot and preserves deterministic lane order in results.
• Keeps successful lane output when another lane fails or is cancelled, with group status derived from the complete lane set.
• Exposes the roster in Agent Models settings and the debug MCP app_settings surface.
• Integrates group execution with Context Builder, Oracle history, tool cards, and direct headless MCP.
• Preserves the existing single-Oracle path when no additional Oracle is configured.

Implementation Notes

• Shared domain contracts own roster validation, lane identity, ordered results, coordinator behavior, claims, and persistence.
• App and direct-headless adapters use those contracts rather than implementing separate group semantics.
• Context Builder commits one immutable roster per run and maps every lane back to the originating tool card/history entry.
• Responses remain independent by design; this PR does not add synthesis, voting, or cross-lane prompting.
• Compatibility behavior is limited to the existing one-Oracle contract and persisted Oracle history migration.

Scope

This PR is intentionally limited to multiple-Oracle configuration, execution, persistence, presentation, and the tests required for those boundaries. It does not redesign unrelated Agent Mode workflows, provider selection, general chat, file selection, or MCP tool behavior.

Review Approach

• Review the complete branch against main, not only the last commit.
• Treat unrelated refactors, speculative abstractions, compatibility layers without an observed contract, and changes outside the multi-Oracle boundary as must-fix scope issues.
• Verify the one-Oracle fallback, ordered duplicate lanes, partial failure/cancellation, durable history, Context Builder mapping, and direct-headless parity.

Validation

• Conductor built, ad-hoc signed, and validated the exact af733abb debug app bundle; its embedded MCP helper smoke passed. CUA Driver then launched that exact executable background-only and preserved the user's foreground app.
• A fresh live Context Builder call at af733abb ran four concurrent Oracle lanes. Primary Oracle, Oracle 2, Oracle 3, and Oracle 4 each returned PR796_AF733ABB_FOUR_ORACLE_OK; group 46F0B699-9604-457F-AFAC-2343571824E0 completed.
• ContextBuilderStrictFinalizationTests pass 7/7, including the deterministic post-reservation replacement race; ContextBuilderOracleGroupStateTests pass 2/2; SettingsJSONOnlyPersistenceTests pass 101/101, including testWorktreeVisualIdentitySavesAndLoads; strict SwiftFormat/SwiftLint checks pass.
• The repeated full-PR rpce-review-cli review at exact head af733abb reports NO MUST-FIXES, no defensibly unrelated or overengineered committed hunk, and merge-ready.
• Exact-head hosted CI for af733abb is fully green across Style, all four app-test shards, Sentry-enabled build, provider tests, and secret scan. Shard 3 specifically passed the complete Settings persistence partition, including SettingsJSONOnlyPersistenceTests.testWorktreeVisualIdentitySavesAndLoads.
• A local full-suite attempt also exposed the pre-existing PersistentAgentModeMCPReadFileConnectionTests.testPairAgentOwnedNoRangeReadSelectsNonEmptyWorktreeLogicalFile workspace-selection failure in isolation. Its unrelated stabilization remains deliberately excluded from this PR.

Screenshots

[morluto]

Audit disposition — preferred Oracle successor, with two blockers (2026-08-14)

This should supersede #782 and the Oracle portion of #775, but two authority issues remain before merge.

First, artifact reservations are stored in a process-local registry while the conversation store and claims are shared across processes. Another app/headless process can delete an artifact between reservation and durable conversation linkage. Use a durable/file-locked lease or make artifact creation and prepared-conversation publication one atomic transaction.

Second, the UI derives lane failure by inspecting assistant text for an Error: prefix. Legitimate content can match that string, and real failures need not. Project OracleLaneResultStatus into the UI instead. After those fixes, rerun the green exact-head/live group scenarios.

[morluto]

Deep-review assessment — 2026-08-14

Disposition: preferred Oracle successor, but two correctness issues remain. The shared roster/lane contracts, independent ordered execution, partial-failure preservation, durable group history, app/direct-headless adapters, single-Oracle bypass, green exact-head CI, and live four-lane canary make this the branch to continue. It should supersede #782 and the Oracle half of #775.

Before merge, replace the process-local artifact reservation registry with a durable/file-locked lease or make artifact publication and prepared-conversation linkage one atomic store transaction; another process sharing the store can otherwise delete an artifact between reservation and durable reference. Also project lane success/failure from structured OracleLaneResultStatus, not by parsing assistant text beginning with Error:. A legitimate answer can match that text heuristic and a real failure can render differently.