cli: implement client AHP control functionality

[connor4312]

• Updatese dependencies along with rust: update dependencies dev-tunnels#624. Some deps were a couple years old so this caused some churn (first commit)
• Adopt client relay updates from rust: implement relay client dev-tunnels#626. These are not merged yet, so Cargo.toml temorarily points at the fork (by commit hash)
• Migrate code agent-host to code agent host (aliased by just code agent).
• code agent ps/stop/kill are management commands that all work nicely over AHP
• code agent host --tunnel will launch an agent host that listens on a tunnel
• code agent ps/stop/kill accept both an --address ws://... and a --tunnel <name> to speak over. Without these args they attach to the locally running agent host

[github-actions]

Base: e78dfbd5 Current: 6e761c13

No screenshot changes.

[Copilot]

Pull request overview

Implements end-to-end CLI support for controlling an Agent Host over the Agent Host Protocol (AHP), including local discovery via lockfiles and optional connectivity via dev tunnels, while updating the CLI’s Rust HTTP stack and dependencies to support the new flow.

Changes:

• Add code agent ... subcommands (host/ps/stop/kill/logs) and AHP client + auth retry support.
• Add tunnel-based connection path for agent host control commands, and support hosting an agent host over a tunnel.
• Modernize CLI internals: upgrade to hyper 1/http 1, replace async-trait/lazy_static/chrono/opentelemetry usage, and refresh dependencies.

Show a summary per file

File	Description
src/vs/platform/agentHost/node/copilot/copilotAgent.ts	Include protected resource metadata in auth-required protocol errors.
cli/src/util/sync.rs	Replace async_trait usage with boxed-future async trait methods.
cli/src/util/prereqs.rs	Replace lazy_static with LazyLock; small formatting tidy-ups.
cli/src/util/http.rs	Introduce shared HyperBody helpers; migrate HTTP types to http/hyper 1 patterns; replace async-trait with boxed futures.
cli/src/util/errors.rs	Add NoRunningAgentHost; adjust listen error type to std::io::Error.
cli/src/update_service.rs	Update calls to SimpleHttp to use the new boxed-future async API.
cli/src/tunnels/service_windows.rs	Remove async_trait import/annotation from service manager implementation.
cli/src/tunnels/service_macos.rs	Remove async_trait import/annotation from service manager implementation.
cli/src/tunnels/service_linux.rs	Remove async_trait import/annotation from service manager implementation.
cli/src/tunnels/service.rs	Remove async_trait usage; keep async trait fns relying on crate-level allow.
cli/src/tunnels/protocol.rs	Replace chrono timestamps with jiff timestamps in tunnel singleton status.
cli/src/tunnels/legal.rs	Replace lazy_static with LazyLock for embedded license text.
cli/src/tunnels/dev_tunnels.rs	Adopt updated dev-tunnels API (client relay, endpoint types); add client-side tunnel port connection support.
cli/src/tunnels/control_server.rs	Migrate server connection handling to hyper 1; remove OpenTelemetry socket bandwidth span events; expose socket stats fields.
cli/src/tunnels/code_server.rs	Replace lazy_static with LazyLock; remove OpenTelemetry span usage; improve listening output formatting.
cli/src/tunnels/agent_host.rs	Migrate agent host proxying (HTTP/WS) to hyper 1 + http-body-util helpers; improve WS proxy logging.
cli/src/state.rs	Add agent_host_lockfile() path helper.
cli/src/self_update.rs	Minor simplifications to Option error conversions.
cli/src/log.rs	Remove OpenTelemetry tracer/spans; switch timestamp formatting to jiff.
cli/src/lib.rs	Allow async_fn_in_trait at crate level.
cli/src/desktop/version_manager.rs	Replace lazy_static with LazyLock for commit regex.
cli/src/constants.rs	Replace lazy_static with LazyLock for global computed constants.
cli/src/commands/tunnels.rs	Remove span wrapper around prereq verification; minor visibility tweak for tunnel arg helper.
cli/src/commands/serve_web.rs	Migrate server implementation from hyper 0.14 Server to per-connection hyper 1 serving.
cli/src/commands/output.rs	New output helpers: styles, paging (external + built-in), and banner formatting utilities.
cli/src/commands/args.rs	Replace agent-host with agent command group; add subcommands/flags for agent host management and tunnel access.
cli/src/commands/agent_stop.rs	New: cancel active session turn via AHP (subscribe + dispatch cancel).
cli/src/commands/agent_ps.rs	New: list sessions via AHP, support JSON output and paging.
cli/src/commands/agent_logs.rs	New: stream subscription events/actions for a session with formatted output.
cli/src/commands/agent_kill.rs	New: kill agent host process tree using lockfile discovery.
cli/src/commands/agent_host.rs	Rework agent host proxy: token enforcement at proxy layer, tunnel serving support, lockfile writing for discovery.
cli/src/commands/agent.rs	New: shared AHP connect/auth helpers (local, direct address, or tunnel relay + WS handshake).
cli/src/commands.rs	Export new agent command modules and output helpers.
cli/src/bin/code/main.rs	Wire code agent ... subcommands into CLI entrypoint; remove tracer creation from logger setup.
cli/src/auth.rs	Replace chrono with jiff; add auth namespaces + scoped login; replace async-trait with boxed futures for tunnels auth provider.
cli/src/async_pipe.rs	Remove hyper Accept adapter; replace async-trait with boxed futures for accept abstraction.
cli/Cargo.toml	Update dependency set for hyper 1/http 1/tunnel relay/AHP crates; remove older deps (async-trait, chrono, opentelemetry, lazy_static).
cli/Cargo.lock	Lockfile updates reflecting dependency upgrades and new crates.

Copilot's findings

Comments suppressed due to low confidence (1)

cli/src/commands/agent_host.rs:206

• The lockfile stores address: format!("ws://{bound_addr}/") (trailing slash), which doesn’t match the documented example for AgentHostLockData.address and differs from other URLs produced by this command. Consider storing ws://{bound_addr} (no trailing slash) or updating the documentation/consumers to consistently expect the slash.

	let lock_data = AgentHostLockData {
		address: format!("ws://{bound_addr}/"),
		pid: std::process::id(),
		connection_token: args.connection_token.clone(),
		tunnel_name: tunnel_name.clone(),
	};

• Files reviewed: 37/38 changed files
• Comments generated: 3