[jefft72]

Summary

Adds a hosted server for the current Pi-based Diffex coding agent and carries the existing native protocol over authenticated WebSockets.
The server persists a stable cloud session immediately, supports prompt, steer, abort, transcript, model, and thinking operations, and durably reports token usage without importing any archived diffex-legacy code.

This is the first PR in the diffex repository stack and establishes the runtime that diffex-cloud will start inside each Daytona sandbox.

Reasoning

The Pi harness is now the product runtime, so hosted sessions should execute that same implementation rather than translate requests through a legacy command API.
Reusing @earendil-works/diffex-protocol preserves one wire contract for local and hosted execution and keeps transport concerns out of agent behavior.

The runtime is intentionally locked to the provider and model selected by the control plane.
It persists the session before accepting work, authenticates the WebSocket upgrade, deletes the injected model-key placeholder before child processes can inherit it, and keeps a durable usage outbox so temporary cloud failures do not lose billing data.

Changes

• Adds the @earendil-works/diffex-coding-agent-server package and CLI
• Adds authenticated WebSocket server and client transports for the native protocol
• Persists hosted sessions immediately for stable reconnect behavior
• Adds prompt, steer, abort, transcript, model, and thinking message handling
• Adds durable, retryable, idempotent token-usage reporting
• Locks hosted sessions to the configured provider and model
• Adds package documentation and focused runtime tests

Testing

• npm run hydrate:model-data
• npm run build:offline
• npm run check
• npm run test --workspace @earendil-works/diffex-coding-agent-server - 4 tests
• npm run test --workspace @earendil-works/diffex-client - 36 tests
• npm run test --workspace @earendil-works/diffex-server - 50 tests
• npm audit --audit-level=high - zero vulnerabilities