refactor: move agentrun session policy into yaml

config/agentrun.yaml

@@ -33,6 +33,21 @@ auth:
 client:
   role: render-only
   transport: direct-http
+  sessionPolicy:
+    tenantId: unidesk
+    projectId: default
+    providerId: G14
+    backendProfile: codex
+    workspaceRef:
+      kind: opaque
+      path: .
+    executionPolicy:
+      sandbox: workspace-write
+      approval: never
+      timeoutMs: 900000
+      network: enabled
+      secretScope:
+        allowCredentialEcho: false
 
 controlPlane:
   default:
@@ -178,7 +193,25 @@ controlPlane:
           name: agentrun-v01-mgr-db
           key: DATABASE_URL
         localPostgresExpectedAbsent: false
-      secrets: []
+      secrets:
+        - id: provider-codex-auth-json
+          sourceMode: file
+          sourceRef: /root/.codex/auth.json
+          targetRef:
+            namespace: agentrun-v01
+            name: agentrun-v01-provider-codex
+            key: auth.json
+          providerCredential:
+            profile: codex
+        - id: provider-codex-config
+          sourceMode: file
+          sourceRef: /root/.codex/config.toml
+          targetRef:
+            namespace: agentrun-v01
+            name: agentrun-v01-provider-codex
+            key: config.toml
+          providerCredential:
+            profile: codex
 
     v02:
       node: D601
@@ -334,6 +367,8 @@ controlPlane:
             namespace: agentrun-v02
             name: agentrun-v01-provider-codex
             key: auth.json
+          providerCredential:
+            profile: codex
         - id: provider-codex-config
           sourceMode: file
           sourceRef: /root/.codex/config.toml
@@ -341,6 +376,8 @@ controlPlane:
             namespace: agentrun-v02
             name: agentrun-v01-provider-codex
             key: config.toml
+          providerCredential:
+            profile: codex
         - id: provider-deepseek-auth-json
           sourceMode: file
           sourceRef: /root/.codex-deepseek-v4-pro/auth.json
@@ -348,6 +385,8 @@ controlPlane:
             namespace: agentrun-v02
             name: agentrun-v01-provider-deepseek
             key: auth.json
+          providerCredential:
+            profile: deepseek
         - id: provider-deepseek-config
           sourceMode: file
           sourceRef: agentrun/d601-v02-provider-deepseek-config.toml
@@ -355,6 +394,8 @@ controlPlane:
             namespace: agentrun-v02
             name: agentrun-v01-provider-deepseek
             key: config.toml
+          providerCredential:
+            profile: deepseek
         - id: tool-github-pr-token
           sourceRef: /root/.config/unidesk/github.env
           sourceKey: GH_TOKEN