feat: define canonical client surface roles and capability matrix

.gitignore

@@ -165,29 +165,57 @@ build/spotless-prettier-node-modules-*/serve.js
 /ephemeral
 # START AI Agent Symlinks
 .agent/commands
+.agent/commands.bak.*
+.agent/rules/
 .agent/rules/instructions.md
+.agent/rules/instructions.md.bak.*
 .agent/skills
+.agent/skills.bak.*
+.agent/skills/
+.agents/skills/*.bak
 .claude/commands
+.claude/commands.bak.*
 .claude/commands/
 .claude/skills
+.claude/skills.bak.*
 .claude/skills/
 .codex/commands
+.codex/commands.bak.*
 .codex/config.toml
 .codex/instructions.md
+.codex/instructions.md.bak.*
 .codex/skills
+.codex/skills.bak.*
 .gemini/commands
+.gemini/commands.bak.*
 .gemini/commands/
 .gemini/settings.json
 .gemini/skills
+.gemini/skills.bak.*
 .gemini/skills/
 .github/agents
+.github/agents.bak.*
 .github/copilot-instructions.md
+.github/copilot-instructions.md.bak.*
 .mcp.json
 .opencode/command
+.opencode/command.bak.*
+.opencode/command/
 .opencode/skills
+.opencode/skills.bak.*
+.opencode/skills/
 .vscode/mcp.json
 AGENTS.md
+AGENTS.md.bak.*
 CLAUDE.md
+CLAUDE.md.bak.*
 GEMINI.md
+GEMINI.md.bak.*
+clients/agent-runtime/CLAUDE.md
+clients/agent-runtime/CLAUDE.md.bak.*
+clients/web/apps/dashboard/CLAUDE.md
+clients/web/apps/dashboard/CLAUDE.md.bak.*
+modules/agent-core-kmp/CLAUDE.md
+modules/agent-core-kmp/CLAUDE.md.bak.*
 opencode.json
 # END AI Agent Symlinks

clients/agent-runtime/src/main.rs

@@ -1230,10 +1230,10 @@ fn save_pending_openai_login(config: &Config, pending: &PendingOpenAiLogin) -> R
     let json = serde_json::to_vec_pretty(&persisted)?;
     std::fs::write(&tmp, json)?;
     set_owner_only_permissions(&tmp)?;
-    std::fs::rename(tmp, &path).or_else(|err| {
+    std::fs::rename(&tmp, &path).or_else(|err| {
         if err.kind() == std::io::ErrorKind::AlreadyExists {
             std::fs::remove_file(&path).ok();
-            std::fs::rename(tmp, &path)
+            std::fs::rename(&tmp, &path)
         } else {
             Err(err)
         }