Stabilize swarm activation control lifecycle

[dennisonbertram]

Closes #1046

Related: #1000, #1045, #1043, #1041, #1033, #1076

What changed

• give the unrestricted control run a dedicated context-aware provider that blocks through activation and tool-definition inspection
• release that provider only after the unrestricted assertion, then require normal run completion
• preserve both the denied-member and unrestricted-activation assertions
• keep the repair test-only; production swarm policy and lifecycle code are unchanged

Why

The member run consumed both scripted provider turns. The unrestricted control could then terminate before the test inspected its activated tool definitions, and terminal cleanup removed the activation. That made TestAgentSwarmDeniedForMemberRuns intermittently report agent_swarm missing even though production authorization was correct.

This exact race blocked the production merge gate for #1076/#1079. PR #1047 keeps the control run live at the point whose behavior the test intends to assert.

Verification on rebased head

Exact head: 34c0d8627558b13851ef81ec0d25c930c045b883

Rebased onto: 3384616a8598a7fb73638220601a4a7d24c9eced

• go test ./internal/harness -run '^TestAgentSwarmDeniedForMemberRuns$' -count=100 — PASS
• go test -race ./internal/harness -run '^TestAgentSwarmDeniedForMemberRuns$' -count=100 — PASS
• ./scripts/test-regression.sh — PASS
  • normal suite — PASS
  • race suite — PASS
  • coverage gate — PASS (85.6%, zero-functions=0)
• git diff --check origin/main...HEAD — PASS

The earlier hosted race failure on the stale PR head was an unrelated retention race that is already fixed on current main. The known provider-key capture synchronization defect was then repaired and merged separately by #1053. Hosted checks will rerun on this exact rebased head.

Rollout and rollback

This changes test synchronization only. Rollback is a normal revert of this PR; no production data or schema migration is involved.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[dennisonbertram]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: a70eede88c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".