Roll out the unrolled agent loop in Desktop with configurable operations

**What problem would this solve?**

The unrolled agent loop is currently selected through the process-wide `GOOSE_STATE_MACHINE` flag. Goose Desktop should be able to adopt it by default without changing the behavior of the CLI or other ACP clients that may use the same backend.

Desktop also needs a way to return to the legacy loop during the rollout. Separately, operators need a way to disable individual operations in the unrolled pipeline without adding Desktop-specific behavior to the backend.

Today, bang-shell input is also a special case that selects the unrolled loop even when the flag is off. That makes the loop choice inconsistent and prevents bang shell from being an unrolled-loop-only feature.

**What would a good outcome look like?**

- Goose Desktop uses the unrolled agent loop by default.
- Desktop has a persisted setting that can switch back to the legacy loop.
- The Desktop choice is sent on each ACP prompt as client-scoped metadata.
- Other ACP clients and the CLI keep their current default behavior.
- Bang shell no longer selects the unrolled loop. It is available only as an operation within that loop.
- Existing state-machine cleanup and lifecycle coverage is preserved before the Desktop rollout is enabled.

**Possible approaches**

Desktop can send an explicit value in ACP prompt metadata:

```json
{
"_meta": {
"goose": {
"unrolled_agent_loop": true
}
}
}
```

Desktop should send `false` when the setting is off rather than omitting the value. Clients that do not know about this setting omit it.

Suggested precedence:

1. An explicit ACP metadata value selects the loop for that prompt.
2. If the metadata is absent, `GOOSE_STATE_MACHINE` remains the existing development/rollout override.
3. Otherwise, the legacy loop remains the default.