Design Turso cloud configuration model

Context

Future work from docs/superpowers/specs/2026-05-24-local-libsql-migration-design.md.

The local libsql migration is a prerequisite. This issue should not be implemented until right-db owns the database driver boundary and the workspace no longer exposes raw rusqlite types.

Scope

• Define where Turso database URL, auth token reference, and mode selection live.
• Keep credentials outside agent sandboxes.
• Decide how bot-managed operational settings relate to agent.yaml and CLI config.
• Preserve local-only behavior as the default for existing agents.

Acceptance Criteria

• Configuration supports local-only mode without new required fields.
• Turso credentials are not written into sandbox-owned files.
• right agent config or Telegram bot control-plane behavior is documented according to project rules.
• Architecture docs describe the resulting config contract.

Out Of Scope

• Embedded replica implementation.
• Backup/restore UX.
• Sync health checks.

Start by reading docs/superpowers/specs/2026-05-24-local-libsql-migration-design.md and confirm the prerequisite right-db driver boundary. Review how agent.yaml, CLI configuration, and Telegram bot control-plane behavior are currently defined. Done means documenting an architecture-level configuration contract that preserves local-only defaults and keeps Turso credentials outside sandbox-owned files.