feat(runner): complete Fleet enrollment and runner details (RUN-12, RUN-13) - #373

Wrap the generated fleet control stubs in a high-level client for lifecycle, state watch, and settings RPCs.

Map proto responses into desktop-facing models while preserving optional settings update presence semantics, and cover the mapping behavior with tests.

Add the local fleet control client to SwiftUI environment values and app scene injection.

Start the fleet control transport outside daemon startup, log through the fleet category, and close it during app termination.

Drive fleet agent state from the local control watch stream.

Add lifecycle actions, settings updates, reconnect backoff, and user-readable error handling for the runners dashboard.

Consume the signed-in OIDC session to list Platform workspaces and issue workspace-scoped Fleet enrollment tokens.

Wire token issuance into local Fleet Agent enrollment and configure the Platform endpoint for app and CI builds.

…tate (RUN-9)

Replace RUN-9 sample data and stub actions with FleetViewModel watch snapshots, workspace enrollment, and local drain/resume controls.

Expose the runner section in release builds and cover the presentation-state mapping.

Let ArcBoxTests consume FleetControlClient through the hosted ArcBox target, avoiding Xcode’s duplicate dynamic gRPC package graph.

Handle runner item-selection deep links explicitly so navigation remains exhaustive.

- coordinate authenticated token handoff with local Agent state
- keep Fleet watch and client transport app-scoped
- reconcile unknown outcomes and graceful termination

On macOS 26, any state change inside a fixedSize(vertical: true)
subtree triggers a window-sizing pass that resizes the window — or the
NavigationSplitView content when the window cannot grow — to the
screen's visible-frame height, sliding the sidebar under the title bar
and pushing the account button off-screen. Drop the modifier from the
dynamic error label (it wraps identically without it) and document the
pitfall in AGENTS.md.

Replace the OIDC Authorization Code + PKCE flow with the Better Auth
device-authorization grant: request a device code, open the approval page
in the default browser, and poll the token endpoint per RFC 8628. The
polled access token is an opaque Better Auth session token with a sliding
server-side expiry, sent as the platform API bearer — the token the
platform actually accepts, unblocking fleet enrollment token issuance.

Identity now comes from the provider session endpoint instead of OIDC
userinfo/ID-token claims, and sign-out revokes the session server-side.
The Keychain store self-heals by clearing pre-device-flow token blobs.
PKCE, discovery, code exchange, token refresh, and the custom-scheme
OAuth callback (including its DeepLinkRouter leg) are gone; build
configuration keys are unchanged. The Account pane and runner section
show the confirmation code with reopen-browser and cancel affordances
while approval is pending.

Prevent concurrent device sign-in tasks, expose recovery for terminal Fleet states, and complete the test-target and cancellation cleanup validated by the full app suite.

…hots

Credential-rejected and detached snapshots ignored loadState, so a
disconnected watch still offered the unenroll recovery action against
a stale snapshot. Extract the unenrolled branch's loadState switch
into connectivityOverride and reuse it for all three terminal cases.

…-auth

# Conflicts:
#	ArcBox.xcodeproj/project.pbxproj
#	ArcBox/App/AppDelegate.swift
#	ArcBox/App/DeepLinkRouter.swift
#	ArcBox/ArcBoxApp.swift
#	ArcBox/Info.plist
#	ArcBox/Models/NavItem.swift
#	ArcBox/Views/Settings/AccountSettingsView.swift
#	ArcBox/Views/Settings/SettingsView.swift
#	ArcBox/Views/SidebarAccountButton.swift
#	Packages/ArcBoxAuth/Sources/ArcBoxAuth/Session/AuthSession+SignIn.swift
#	Packages/ArcBoxAuth/Tests/ArcBoxAuthTests/AuthSessionTests.swift

…eat/run-12-13-runner-details

# Conflicts:
#	ArcBox.xcodeproj/project.pbxproj
#	ArcBox/Views/ContentView.swift