Add UI 'None' auth option and no-auth harness behavior config

[ptone]

Summary

• Add "No Authentication" option to the harness auth dropdown in both agent-create and agent-configure UI pages
• Map harnessAuth="none" to NoAuth=true on agent's AppliedConfig in Hub handlers, with full propagation through the broker dispatch chain (RemoteCreateAgentRequest → broker CreateAgentRequest → startContextInputs → StartOptions)
• Add no_auth config section (with drop-to-shell behavior and setup message) to all four harness config.yaml files (claude, gemini, codex, opencode)
• Add HarnessNoAuthConfig struct and NoAuthConfig field to HarnessConfigEntry, plus JSON schema validation
• Implement drop-to-shell behavior in runtime: when NoAuth=true and harness config specifies drop-to-shell, the container prints the setup instructions and drops to a shell instead of launching the harness CLI

Test plan

• go build ./... passes
• gofmt clean on all modified files
• golangci-lint run --new-from-rev=origin/main — 0 new issues
• go vet clean on all modified packages
• Harness config validation tests pass (schema accepts no_auth section)
• Runtime, harness, store, hub, runtimebroker tests pass
• Pre-existing test failures in pkg/agent and pkg/config confirmed unrelated (fail on origin/main too)

[gemini-code-assist]

Code Review

This pull request introduces a 'NoAuth' mode allowing agents to start without credentials, dropping them directly to a shell with custom setup instructions. It updates harness configurations, schemas, Go structs, backend propagation logic, and the frontend UI to support this new authentication option. The review feedback highlights a critical logic issue in both pkg/runtime/common.go and pkg/runtime/k8s_runtime.go where dropping to a shell is bypassed if NoAuthMessage is empty; it is recommended to check NoAuth independently and default to launching a shell even when no message is provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If config.NoAuth is true but config.NoAuthMessage is empty (for example, if a harness config defines behavior: drop-to-shell but omits the optional message field), the condition config.NoAuth && config.NoAuthMessage != "" will evaluate to false. This causes the runtime to fall through and launch the harness CLI instead of dropping to a shell, which breaks the expected NoAuth behavior.

We should check config.NoAuth independently and drop to a shell, optionally printing the message if it is provided.

	if config.NoAuth {
		if config.NoAuthMessage != "" {
			harnessArgs = []string{"sh", "-c", fmt.Sprintf("printf '%%s\\n' %s; exec bash", shellQuote(config.NoAuthMessage))}
		} else {
			harnessArgs = []string{"bash"}
		}
	} else if config.Harness != nil {

[gemini-code-assist]

If config.NoAuth is true but config.NoAuthMessage is empty (for example, if a harness config defines behavior: drop-to-shell but omits the optional message field), the condition config.NoAuth && config.NoAuthMessage != "" will evaluate to false. This causes the runtime to fall through and launch the harness CLI instead of dropping to a shell, which breaks the expected NoAuth behavior.

We should check config.NoAuth independently and drop to a shell, optionally printing the message if it is provided.

Suggested change

	if config.NoAuth && config.NoAuthMessage != "" {
	harnessArgs = []string{"sh", "-c", fmt.Sprintf("printf '%%s\\n' %s; exec bash", shellQuote(config.NoAuthMessage))}
	} else if config.Harness != nil {
	if config.NoAuth {
	if config.NoAuthMessage != "" {
	harnessArgs = []string{"sh", "-c", fmt.Sprintf("printf '%%s\\n' %s; exec bash", shellQuote(config.NoAuthMessage))}
	} else {
	harnessArgs = []string{"bash"}
	}
	} else if config.Harness != nil {