Launch a deterministically prepared Agent session in its native UI

[taras]

Story

As a repository user, I want an executable document target to construct a
coding-agent session deterministically and open that exact session in the
agent's native UI, so I enter Claude Code, Codex, or another compatible UI with
the selected instructions and filesystem configuration already established.

The delivered Claude experience is:

xmd run AGENTS.md#Implementor --default-agent claude

The filename is not special. Existing document target selection chooses
Implementor; executing that target prepares and launches the session.

Executable surface

The general operation and component are:

Agent.launch(instructions, options)

<Session.Launch>
 ...explicitly prepared instructions...
</Session.Launch>

The component body is evaluated before launch, and only the rendered value
crosses the agent boundary as prepared instructions. Surrounding Markdown
remains human-facing output.

XMD remains the supervising parent while the provider's native UI owns the
terminal. It does not implement a terminal chat frontend, proxy model turns, or
own provider conversation history.

Delivered

PR #518 supplies the provider-neutral launch operation, component, lexical
Agent/Session configuration, foreground terminal supervision, cancellation,
provider authority, session coordinator, durable phases, replay, and
fail-closed advertisement gate.

PR #559 supplies the client-native construction path:

• adapter-allocated provider identity with explicit client-allocated
  provenance;
• direct native creation from a restrictive private instruction file;
• native resume under the retained identity;
• a strict create-once client-native / acp-first construction route;
• phase-sensitive replay and identity preservation;
• ACP-first publication before ACP construction;
• fail-closed Session/Prompt refusal on client-native history; and
• Deno/compiled host assembly and Node/Bun refusal.

Issue #520 and PR #562 prove the production Claude path against Claude Code
2.1.241 on macOS arm64 and advertise claude. The checked-in
AGENTS.md#Implementor target now constructs the native session with prepared
instructions before the first user turn and later resumes the same retained
identity. codex remains unadvertised.

PRs #549 and #550 subsequently establish retained workflow Agent sessions and
the XMD-mediated observation loop. Their provider-session retention and
ownership contracts are part of the current foundation against which later ACP
attachment must be designed.

Follow-up work

ACP attachment to client-native sessions was delivered by PR #568, closing
#561. Additional working directories are tracked separately in #682 and are
not part of this completed session-launch story.

Invariants

• Target discovery and help execute no preparation, provider call, or process.
• Only the selected target executes; sibling roles stay inert.
• Only explicitly rendered Session.Launch content crosses as instructions.
• Launch performs no hidden Prompt or bootstrap model turn.
• Provider-native identity is provider-returned or client-allocated by a proven
  adapter, retained explicitly, and never inferred from UUID shape or unrelated
  ACP/ACPX identifiers.
• Prepared instructions never appear in argv or environment. A restrictive
  invocation-private file may cross by path and is removed during owned cleanup.
• ACP and the native UI never own one logical session concurrently.
• XMD remains the parent, forwards cancellation, reaps the foreground child,
  restores the terminal, and resumes the document only after settlement.
• Construction routes are strict, create-once, and never converted or deleted
  to make a later operation succeed.
• A changed instruction layer never discards provider-owned history.
• Completed replay launches nothing; incomplete replay preserves the retained
  identity and never substitutes another conversation.
• Provider adapters are advertised only after an opt-in real integration proves
  the claims applicable to their identity provenance.
• Author-facing behavior is proven in executable Markdown. TypeScript owns only
  protocol, persistence, process, PTY, and real-provider seams the document
  cannot observe.

Out of scope

• an XMD-provided interactive chat loop;
• bootstrap prompts, tracked separately in Allow an explicit bootstrap turn when native session instructions are unavailable #514;
• automatic discovery or injection of nested AGENTS.md files;
• simultaneous interactive ownership by multiple sessions;
• native transcript mirroring or reconstruction;
• provider-private transcript inspection;
• workflow role scheduling; and
• claiming support for a provider before its applicable native integration
  proof passes.

The normative implementation contract is
specs/native-agent-session-launch-spec.md. Additional working directories are
tracked separately in #682.