feat(harness): continue web-ai turns with a bounded MCP loop

[jazelly]

Summary

• Add continue-turn to the web AI protocol and daemon so a succeeded conversation can accept tool-result follow-ups without a new bootstrap.
• Add a bounded Harness MCP loop that discovers Codex-shaped tools, executes correlated action batches, and continues the same visible conversation until final.
• Keep only two P0 roadmap closures (Harness response handling and GPT4Free Direct), register browser guest-policy candidates, and document the Responses route, Codex subagents, and G4F uv requirement.

Test plan

• npm test -- test/web-agent-harness-local-http.integration.test.mjs
• Gated: TOKENLESS_RUN_LINEAR_MCP_OAUTH=1 test/mcp-linear-oauth.e2e.mjs
• Gated: test/mcp-remote.real-boundary.e2e.mjs
• Confirm a continue-turn against a succeeded web-ai conversation reuses the provider conversation
• Confirm docs for Responses, Codex subagents, and G4F uv match the shipped behavior

[jazelly]

Fresh independent agent review found three actionable issues:

1. [P1] Continuation advances local Harness state before durable remote turn creation. local-http-bootstrap.ts:105 calls prepareHarnessSkillTurn, which immediately advances nextTurn and records loaded skills in skill-harness.ts:445. If later skill staging or client.continue fails, retrying the same action batch cannot safely recover and the skill is recorded as delivered. Use pending/commit/rollback semantics, an idempotent request reference, or commit state only after durable continuation start succeeds.

2. [P1] MCP execution does not enforce the discovery-time frozen tool catalog. mcp-client.ts:180 resolves calls from the current Codex config, while resolveMcpTool around lines 702–714 checks server/filter policy but not membership in this run's discovered catalog. A model can name an undisclosed or newly-added server tool and execute it when policy permits. Persist the catalog name/schema snapshot and validate every call against it before execution.

3. [P2] Terminal MCP-loop errors do not consistently clear OAuth state or cancel timed-out provider turns. local-http-mcp-loop.ts:114–119 clears auth only on the normal final path; turn-limit, tool, provider, and timeout errors throw without cleanup. The timeout path around lines 168–178 also leaves the provider turn running. Clean up ephemeral auth on terminal errors and cancel the corresponding turn on local timeout, while preserving intentional waiting-for-user flows.

Validation: TypeScript lint passed for the three relevant workspaces. The focused local HTTP integration test was blocked before test logic because this Windows environment lacks a usable koffi prebuilt and CMake. The PR also lacks a non-gated continuation failure/retry boundary test.