Extend claude managed agents in the ui

[nibalizer]

This sets up Agent - Agent binding, leveraging the session tracking that was added previously

Claude agents can now be added to Atryum Agents. Atryum will annotate the agent on the claude side and will error out if a different atryum is managing that Agent already. There is a force checkbox.

🤖 below this line

Summary

Adds first-class Atryum Agent to Claude Managed Agent binding, automatic session discovery, and Claude metadata ownership checks.

What changed

• Added managed_agent_bindings storage and repo support.
• Extended admin agent APIs to read/write linked Claude Managed Agents.
• Added managed-agents admin discovery endpoints for configured accounts and Claude agents.
• Added Anthropic API support for listing/retrieving/updating agents and listing sessions.
• Added automatic discovery of Claude sessions for linked Claude agents.
• Prevented auto-discovery from replaying entire historical sessions; it tails from the current event unless the session is currently blocked on requires_action.
• Added Atryum ownership metadata on linked Claude agents, with conflict detection and force-connect support.
• Required workspace for configured [[managed_agents]] accounts.
• Added optional [server].atryum_instance for stable metadata identity.
• Updated the Agents UI to link Claude Managed Agents from the existing agent edit modal.
• Updated Invocations UI association logic so Claude agent_... IDs resolve to linked Atryum agents.
• Restored invocation status dots and label alignment.
• Updated README/example/website docs for UI linking, workspace config, and auto-discovery.

Behavior notes

• Manual session registration remains available as an escape hatch.
• Binding a Claude Managed Agent marks it with Atryum metadata.
• If metadata indicates another Atryum instance/workspace/agent already owns the Claude agent, save returns 409 Conflict unless force connect is enabled.
• Discovery runs at startup and then every minute.
• Existing sessions are not fully replayed into Atryum; only the current pending approval block is processed if the session is parked on requires_action.

Validation

• go test ./...
• go build ./...
• npm --prefix ui run build
• git diff --check

[hunner]

👬