* X-Smart-Branch-Parent: main

* docs: update all documentation for current CLI state

Audit and update all core documentation to reflect PRs #58-#61:

README.md:
- Add 'What harness up replaces' section showing the single command
  vs 8+ raw openshell commands for a 4-provider agent
- Remove deleted commands (preflight, providers)
- Update config files table (gateway.yaml, remove providers.toml/openshell.toml)
- Add OpenCode support, --provider-refresh flag, --env injection
- Add v0.0.59 prerequisite

SPEC.md:
- Remove deleted commands and config files
- Update payload section (no more env.sh/sandbox.env)
- Document three registration flows (standard, ADC, custom)
- Add --provider-refresh, task -p application, empty env host lookup

AGENTS.md:
- Update sandbox image workaround (adds opencode-ai)
- Fix test target description (bats removed)

sandbox/CLAUDE.md:
- Add opencode as available agent
- Remove stale kubectl/deploy-kubeconfig reference
- Generalize inference description

demo/DEMO-SCRIPT.md:
- Fix entrypoint (claude not claude --bare -p)
- Replace providers.toml with profiles directory
- Replace gateway.toml with gateway.yaml
- Remove harness providers step

* chore: remove demo script and demo agent config

The demo/ directory and agents/demo.yaml were not actively used.
Updated README task agent example to use a generic name.

* refactor: only register providers declared in agent YAML

registerProviders() now takes the agent's provider name list instead of
a gateway config. Only providers listed in the agent YAML are registered
— no more hardcoded list of all four providers.

The agent YAML is the single source of truth for which providers a
sandbox needs. If a provider isn't in the YAML, it's not registered.

* docs: restructure README to show command → file → equivalent

The 'What harness up replaces' section now flows: the harness command,
the agent YAML it reads, then the openshell commands it replaces.
Removed the duplicate Agent Configs section.

* feat: add gateway field to agent config, add OCP agent example

The agent YAML can now specify its deployment target via gateway: field.
harness up reads it to determine local vs remote — no --local/--remote
flag needed when the agent config declares it.

- gateway: local (default) — Podman on your machine
- gateway: ocp — OpenShift cluster
- gateway: kind — local kind cluster
- --local/--remote flags override the agent config

Added agents/ocp.yaml as a concrete example.

* docs: add OCP equivalent openshell commands to README

Show the additional Helm deploy + sandbox create commands that
harness up runs when gateway: ocp is set.

* docs: fix OCP command order — deploy gateway first, then providers

The correct OCP sequence is: namespace + CRD + SCCs + Helm + rollout +
gateway register → then provider registration → then sandbox create.
Previously showed providers before deploy.

* refactor: wire provider config via --config on provider create, not --env

Provider config values (JIRA_URL, JIRA_USERNAME, etc.) now flow through
the provider system via --config on 'openshell provider create' instead
of being merged into --env on sandbox create.

- BuildEnvMap() returns only the agent's env: section (sandbox-level vars)
- ProviderRef.ConfigList() returns config as KEY=VALUE pairs for --config
- registerProviders() takes []agent.ProviderRef instead of []string,
  passing each provider's config to the registration call
- Provider configs are managed by the gateway, not manually injected

* refactor: rename providers[].config to providers[].env, inject via --env

Provider non-secret vars (JIRA_URL, JIRA_USERNAME) are sandbox env vars,
not gateway-managed config. Rename the field from 'config' to 'env' to
make this clear.

Both top-level env: and providers[].env: merge into BuildEnvMap() and
are injected via --env on sandbox create. Provider env overrides
top-level env on collision. The gateway only manages secrets
(credentials) — non-secret vars go directly to the container.

* fix: add gws to status.Cmd logging, sync builtin.yaml with default, update README commands

- Add status.Cmd() call for 'gws auth export --unmasked' so it shows
  with --show-commands
- Add gws provider to builtin.yaml (was missing vs default.yaml)
- Update README 'What harness up replaces' with actual captured output
  from --show-commands (includes gws export, inference set order, env
  var alphabetical order)
- Add --debug flag to test-flow.sh (passes --show-commands, shows output)

* fix: fail fast on provider registration errors, slim down builtin

Provider registration now returns errors instead of silently skipping.
If you declare a provider in your agent YAML, you need it — missing
credentials are a configuration error, not a graceful degradation.

builtin.yaml slimmed to vertex-local only (inference). Users who need
github/atlassian/gws create agents/default.yaml with the full list.