fleet(B0-B8): Multi-agent OpenClaw orchestration

[mojomast]

Summary

This PR implements a complete multi-agent fleet orchestration system for OpenClaw, enabling distributed task execution across multiple hosts.

Features Implemented

B0 - Bootstrap

• Project structure and batch branches
• Development plan with execution manifest

B1 - Schema

• Agent model with status, host metadata, tags
• AgentToken model with SHA-256 digest-only storage
• Task associations for assigned_agent and claimed_by_agent

B2 - Auth

• JoinToken for one-time agent registration
• Dual authentication: User API tokens + Agent tokens
• Cross-user isolation enforced

B3 - Agent Lifecycle API

• POST /api/v1/agents/register - Bootstrap new agents
• POST /api/v1/agents/:id/heartbeat - Health + status updates
• GET/PATCH /api/v1/agents - CRUD operations

B4 - Scheduler

• Race-safe task dispatch with FOR UPDATE SKIP LOCKED
• Agent-aware eligibility (assigned vs unassigned tasks)
• Draining agent support (no new tasks)

B5 - Command Orchestration

• AgentCommand model with state machine (pending→acknowledged→completed)
• Command queue API: enqueue, poll, ack, complete
• Support for drain/resume/restart/upgrade commands

B6 - Go Agent Daemon

• ClawDeck API client in Go
• Heartbeat runner, task loop, command orchestrator
• Stub executor for OpenClaw integration

B7 - Admin UI

• Agents list page with status badges
• Agent detail with command buttons (Drain/Resume/Restart)
• Task assignment dropdown with agent selection
• Visual indicators for assigned/claimed tasks

B8 - Integration & Security

• Concurrency tests for race condition prevention
• Simulated agent harness for E2E testing
• Security documentation (token storage, rotation, command allowlist)

Test Results

• 87 runs, 246 assertions
• All 75 fleet-related tests pass
• 2 pre-existing session redirect tests (unrelated)

Files Changed

• 53 files changed
• 3,894 insertions(+)
• 135 deletions(-)