v1.7 ACP: shared Python client and capability negotiation #1115

Part of #1114 and the v1.7 Operator roadmap #1096.

Implementation order: after alignment with #1085 / PR #1101; establishes the interface consumed by #1116, #1117, and #1118.

Problem and result

Every compatible agent currently needs its own process/session/stream handling, while Code Mower's ACP catalog entry is research-only. Implement one maintained ACP transport that the existing builder and reviewer runners can consume without coupling qualification or authority to the protocol.

Scope: PR 1 of 4

• Use the official Python SDK for JSON-RPC framing and asynchronous client plumbing, with a pinned supported dependency range and deliberate package/extra choice.
• Stable ACP v1 over stdio: initialize, capability/version negotiation, new session, prompt, updates, cancellation, close where supported, and process cleanup.
• Define a small descriptor for argv, explicit environment/auth references, tested capability requirements, agent/model identity, and adapter/version information.
• Bind every run to the caller's isolated checkout, role, job ID, and expected commit; use a fresh session and isolated configuration for each review.
• Support required client callbacks without blocking the stream reader. Handle permission requests according to existing role policy and pause for an owner action when necessary; do not choose blanket auto-approval.
• Bound frame size, queues, startup/run/cancel time, stderr handling, and child-process cleanup. Runtime failure is distinct from a review verdict.
• Keep repository permission enforcement and sandbox isolation in the execution layer. Capability claims alone cannot authorize filesystem, MCP, or terminal access.

Dependencies

Align with #1085 / PR #1101 and existing provider runners. No need to wait for the full Operator service. Coordinate shared Python dependency, package inventory, and provider catalog ownership before editing.

Acceptance

• One reusable transport launches configured argv without a shell and negotiates only supported ACP versions/capabilities.
• Offline fake-agent fixtures cover valid streams, interleaved updates and permission requests, malformed/oversized frames, unsupported versions/capabilities, auth-required, disconnect, timeout, cancellation, and leaked-child prevention.
• Unsupported optional features are reported as absent; unsupported required features fail with a useful explanation.
• Cancellation waits for quiescence or stops the isolated process; uncertain mutations are handed to Code Mower reconciliation rather than automatically replayed.
• Reviewer calls never load a builder's conversation or expose unselected MCP/auth configuration.
• Existing native adapters and packaged default installations remain compatible.
• Canonical docs and the research note identify the supported transport and installation requirement.
• No paid provider calls are needed for the contract tests.

Delivery

One issue per PR and one writer per branch. Prefer diffs of 300 lines or fewer where practical; keep larger protocol/test work tightly scoped and explain it in the PR. Record the named builder, actual agent/model/transport provenance, focused tests, and a canonical documentation update for every behavior change. Obtain an independent eligible Code Mower review against the current commit, resolve all P0/P1/P2 findings, and pass normal CI plus code-mower/gate. Record safe activity in Board and upload only approved metadata through the existing dry-run-first cloud flow. A new transport or passing protocol probe grants no review or merge authority.