[AgonSle]

WorkBuddy desktop login does not make its bundled CodeBuddy CLI independently authenticated. A local probe returned exit code 0, empty stdout and an authentication-required diagnostic, so choosing that binary as a receiver can appear successful without starting a model turn.

This change adds explicit WorkBuddy onboarding (setup --runtime workbuddy, join workbuddy), detection of CODEBUDDY_HOST=workbuddy-desktop, installation into the host's skill directory, and a stable native local scheduling plan. The plan preserves identity and receiving preferences and explicitly remains uninstalled/unverified. Existing listeners are reused.

New Codex/Claude recipes also require a structured terminal success event. Missing completion, model failure and tool denials retain pending work. Legacy custom runners retain their output contract unless they opt into result_protocol.

WorkBuddy realtime wake is not implemented. The native scheduling plan still needs a task installed in WorkBuddy. Actual WorkBuddy desktop tasks completed mailbox round trips against both localhost and an existing Cloudflare instance. Independent API reads verified the reply sender, reply_to, expected results, ACK timestamps after replies, and removal from the pending inbox. These desktop tasks were explicitly submitted through the UI; automatic scheduling and realtime model wake remain unverified. No account tokens were extracted and no debug server was enabled.

The Cloudflare test used this PR's bundled CLI without replacing the deployed Worker. A separate notification client observed an online mailbox change and confirmed that a message sent while disconnected remained pending after reconnect. WorkBuddy then replied to both messages (29 × 31 = 899; 37 × 19 + 11 = 714) and ACKed each. The host initially had conflicting uppercase/lowercase proxy variables: explicit curl requests succeeded while Node fetch failed with ERR_SSL_WRONG_VERSION_NUMBER. Normalizing both cases to the already configured proxy in the private test runtime resolved the CLI failure. TLS verification and the WorkBuddy sandbox remained enabled. The instance's publicly served CLI archive still differs from this PR build.

Validation:

• node --test --test-concurrency=1 tests/*.test.mjs .test/*.test.mjs: 156 passed after integration with current main.
• npm run check: passed.
• npm run test:sqlite: 46 passed.
• Release CLI and generated public assets built; explicit WorkBuddy join tested from source and the bundled CLI.
• Actual WorkBuddy desktop reply plus ACK verified against an independent localhost instance.
• Actual WorkBuddy desktop reply plus ACK verified against Cloudflare for online and offline messages; notification transport and reconnect checked separately from model wake.
• GitHub CI verify and sqlite-backend: passed for 1b6ea45.
• D1 and SQLite browser regressions passed after integration with current main.
• Initial concurrent macOS run: 155/156; the listener-process timing test timed out. The complete serial rerun passed all 156 tests; Linux CI also passed.
• CLI release version: 0.1.20; package metadata, lockfile and release notes updated.