feat: give managed agents persistent cryptographic identities

Create encrypted Ed25519 identities on agent creation or first managed run. Deliver runtime credentials, expose public identity, and preserve safe copy and recovery behavior.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cli/src/__tests__/worktree.test.ts

@@ -511,7 +511,8 @@ describe("worktree helpers", () => {
     expect(minimal.excludedTables).toContain("agent_task_sessions");
     expect(minimal.nullifyColumns.issues).toEqual(["checkout_run_id", "execution_run_id"]);
 
-    expect(full.excludedTables).toEqual([]);
+    expect(full.excludedTables).toEqual(["agent_identity_keys"]);
+    expect(minimal.excludedTables).toContain("agent_identity_keys");
     expect(full.nullifyColumns).toEqual({});
   });
 
@@ -2045,8 +2046,8 @@ describe("worktree helpers", () => {
     }
   });
 
-  it("uses streaming backup selection for full seeds and transformed backup selection for minimal seeds", () => {
-    expect(resolveWorktreeSeedBackupEngine(resolveWorktreeSeedPlan("full"))).toBe("auto");
+  it("uses transformed backups for both seed modes to omit agent identities", () => {
+    expect(resolveWorktreeSeedBackupEngine(resolveWorktreeSeedPlan("full"))).toBe("javascript");
     expect(resolveWorktreeSeedBackupEngine(resolveWorktreeSeedPlan("minimal"))).toBe("javascript");
   });
 

cli/src/commands/worktree-lib.ts

@@ -58,6 +58,7 @@ export type WorktreeSeedPlan = {
 };
 
 const MINIMAL_WORKTREE_EXCLUDED_TABLES = [
+  "agent_identity_keys",
   "activity_log",
   "agent_runtime_state",
   "agent_task_sessions",
@@ -118,7 +119,7 @@ export function resolveWorktreeSeedPlan(mode: WorktreeSeedMode): WorktreeSeedPla
   if (mode === "full") {
     return {
       mode,
-      excludedTables: [],
+      excludedTables: ["agent_identity_keys"],
       nullifyColumns: {},
     };
   }