Agent Host: support RemoteAgent providers and brokered sessions

## Summary

Allow an Agent Host to act as an AHP client to other Agent Hosts and contribute each admitted endpoint/provider pair as an ordinary `IAgent` (`RemoteAgent`).

The target three-host flow is:

```text
Host B invokes A's client-contributed create_remote_session tool
-> Host A authorizes the requested target
-> Host A creates a normal session through RemoteAgent(C, provider)
-> Host C starts the work
-> Host B receives A's session/chat handle and open link
```

The created session belongs in A's normal session catalog. B does not receive C's credentials or need to know C's address.

## Confirmed decisions

- Add a host-level master control for outbound remote-Agent-Host functionality.
- Add a separate control for tunnel discovery.
- When enabled, tunnel discovery automatically connects authorized targets and contributes their agents.
- Disabling the master control immediately closes A-owned outbound connections without deleting or cancelling sessions on B/C.
- Tunnel authentication follows VS Code's existing tunnel-client behavior: product-defined scopes, cached-session reuse, explicit optional sign-in, and issuer preservation.
- Tunnel auth is an optional feature-scoped AHP protected resource; declining it must not block local agents.
- Tunnels are the first target contribution. SSH, Dev Containers, and other target types must be addable later without changing `RemoteAgent`.
- Do not automatically re-export remote proxies or forward arbitrary cached credentials.

## Two-person work split

### Person 1: connectivity, discovery, and authentication

- [ ] Host controls and activation/deactivation lifecycle
- [ ] Headless AHP client extraction and Node transport
- [ ] Target-contribution/connection-factory boundary
- [ ] Optional host-feature authentication and VS Code tunnel sign-in integration
- [ ] Authenticated tunnel discovery, automatic connection, and transport reconnection

Independent demo: enable the feature, satisfy optional auth, discover/connect to a tunnel, and read its provider/model catalog.

### Person 2: RemoteAgent and delegation

- [ ] Remote provider registration in the normal catalog
- [ ] `RemoteAgent` implementation and conservative capability mapping
- [ ] Chat/session identity mapping, streaming, cancellation, history, and persistence
- [ ] Permission and user-input routing
- [ ] Client-tool callback and `create_remote_session`
- [ ] Durable session/tool-execution deduplication

Independent demo: use a fake connection or scripted AHP server to expose a normal remote-backed session, complete a chat, and complete a client-tool callback.

## Shared contract to agree first

Person 1 delivers an authenticated, initialized, lifetime-owned AHP connection with:

- stable target, connector, and client identities;
- requests, subscriptions, actions, and notifications;
- connection/reconnection status;
- explicit disposal ownership;
- no transport-specific details exposed to `RemoteAgent`.

Person 2 consumes that contract. Transport replay belongs to Person 1; durable session and tool deduplication belongs to Person 2.

## Integration checkpoints

- [ ] Fixed endpoint: real two-host chat
- [ ] Tunnel: replace the fixed transport without changing `RemoteAgent`
- [ ] Delegation: B asks A to create one normal A session backed by C
- [ ] Recovery: disconnect, disablement, and ambiguous-creation outcomes do not duplicate work
- [ ] Workspace authority: define execution-location ownership before enabling real workspace-backed editing

## Initial non-goals

- External plugin loader or public extension API
- SSH/Dev Container implementations
- Importing all pre-existing downstream sessions
- Peer/fork/subagent parity
- Transparent forwarding of arbitrary upstream tools, customizations, or credentials
- General cyclic federation

A detailed roadmap and file-ownership plan will be linked here from the implementation branch.