feat(desktop): persona engram instantiation + fleet update + legacy sync gate

[wpfleger96]

Summary

Write a mem/persona engram (kind:30174) when creating an agent from a persona, and keep it current via fleet update. Gate the old directory-based team sync behind a feature flag.

Stack: #939 → this PR

Prerequisite: #939 must merge first (this PR targets the wpfleger/persona-events branch). #939 lays the event kind foundation and retention store that this PR builds on.

What Changed

Part A: Persona Engram at Instantiation

In create_managed_agent, after the agent keypair is generated, a mem/persona engram is published to the relay:

• Slug: mem/persona, d-tag derived via engram::d_tag(&conversation_key, "mem/persona") (HMAC-blinded, 64 hex chars)
• Content: NIP-44 encrypted JSON containing the PersonaEventContent fields plus provenance (owner pubkey, kind:30175, persona slug, content SHA-256 digest)
• Authored by the agent, addressed to the owner — conforms to the existing kind:30174 envelope contract
• Best-effort: relay publish failure is logged but never blocks agent creation

Part B: Fleet Update

On app launch and on persona save, fleet update reconciles agent engrams against current persona content:

• Comparison is digest-based (SHA-256 of canonical persona content JSON), not timestamp-based — handles clock skew and export/import round-trips
• No agent restart — the live resolve path still reads the persona catalog at spawn; the engram is provenance and future-proofing
• Missing engrams (pre-PR2 agents) trigger an initial write
• Relay-unreachable is a no-op (logged, non-fatal)

Part C: Legacy Sync Gate

The directory-backed team sync machinery (import_team_from_directory, sync_team_from_dir, sync_team_personas) is gated behind a legacy_team_sync feature flag (default-enabled). Fleet update replaces sync_team_personas in the launch sequence. Old code remains compilable for one release cycle as a rollback path.

Key Design Decisions

• Provenance inside encrypted body (not as a plaintext tag) — preserves the engram's HMAC blinding guarantee
• Uses sprout_core::engram::build_event — reuses the existing engram infrastructure rather than hand-rolling tags
• Option B: live resolve stays — the engram is provenance-only for now; the live resolve_effective_prompt_model_provider path is unchanged. Fleet update keeps the engram current for when it becomes the runtime source.
• Feature flag vs deletion — #[cfg(feature = "legacy_team_sync")] provides a real rollback path (recompile with the flag) rather than just #[deprecated] annotations

Files Changed

• desktop/src-tauri/Cargo.toml — add legacy_team_sync feature (default-enabled)
• desktop/src-tauri/src/commands/agents.rs — write persona engram at creation
• desktop/src-tauri/src/commands/personas.rs — trigger fleet update on persona save
• desktop/src-tauri/src/commands/teams.rs — cfg-gate legacy team commands
• desktop/src-tauri/src/lib.rs — replace sync_team_personas with fleet update spawn
• desktop/src-tauri/src/managed_agents/fleet_update.rs (new) — fleet update module
• desktop/src-tauri/src/managed_agents/persona_events.rs — engram builder, content hash, provenance types
• desktop/src-tauri/src/managed_agents/teams.rs — cfg-gate legacy functions
• desktop/src-tauri/src/managed_agents/env_vars.rs — cfg-gate unused helpers
• desktop/src-tauri/src/managed_agents/mod.rs — register fleet_update module

Tests

• persona_engram_round_trip — build → decrypt → verify content matches original persona
• persona_content_hash_is_deterministic — same content always produces same digest
• persona_content_hash_changes_on_edit — content change produces different digest
• missing_engram_writes — fleet update writes when no engram exists
• matching_hash_is_noop — fleet update skips when content matches
• differing_hash_writes — fleet update writes when content differs