Add generic provider env contribution hook for plugins

[SawyerHood]

Stack layer 1 of 3 (bottom). No prerequisite; layers 2 (account-pool plugin) and 3 (pool wiring) build on it.

Human comments

What was wrong

Plugins could register providers and derive provider options, but there was no validated, per-provider hook for contributing environment variables on each daemon command. As a result the server had nothing to resolve, the versioned host wire carried no contribution metadata, the daemon could only build its fixed shell environment, and Claude did not rebuild its resident SDK session when a turn's merged environment changed. This implements BB-89.

What changed

• Added bb.providers.experimental_contributeEnv(providerId, resolve) with public context and entry types, zod boundary validation, fake-host support, Plugin Guide coverage, the API audit entry, and Plugin API map inventory. The Plugin SDK version is now 0.4.44.
• Added isolated five-second server resolution on every session and turn command, deterministic first-contributor-wins conflict handling, and plugin source attribution without logging values.
• Added required contributedEnv command payloads and bumped HOST_DAEMON_PROTOCOL_VERSION to 180.
• Merged contributions after thread shell variables on the daemon, expanded serverPath values against the daemon's loopback BB_SERVER_URL, and persisted provider.env-resolved events with contributed secrets masked. If that base URL is unavailable, the daemon drops only the unresolved entry, records it as masked, and emits a configuration warning naming the variable and plugin instead of preventing thread startup.
• Passed the merged environment through Codex, Pi, and ACP with contribution precedence over ACP static launch variables.
• Added stable Claude environment signatures and explicit restart-note metadata. A changed turn environment closes and resumes the same provider session id, preserves conversation context, and emits the visible note Execution settings changed; the Claude session was rebuilt to apply them. Ordinary context-preserving session replacements remain hidden.
• Added timeline rendering and regression coverage across SDK validation, server resolution, host contracts, runtime precedence/masking/event suppression, provider bridges, and the fake plugin host.

How you verified

• node .github/workflows/check-plugin-sdk-version.mjs
• pnpm exec turbo run typecheck test --filter=@get-bb/plugin-sdk --filter=@bb/plugin-api-map --filter=@bb/domain --filter=@bb/host-daemon-contract --filter=@bb/thread-view --filter=@bb/provider-bridge-protocol --filter=@bb/agent-runtime --filter=@bb/provider-bridge-acp --filter=bb-plugin-provider-codex --filter=bb-plugin-provider-claude-code --filter=bb-plugin-provider-pi --filter=@bb/server --filter=@bb/host-daemon --continue --force (all typechecks passed; 33/34 test tasks passed, with one load-sensitive Pi test timing out)
• pnpm exec turbo run test --filter=bb-plugin-provider-pi --force (21 files and 121 tests passed sequentially, including the timed-out test)
• After the review fixes and rebase, pnpm exec turbo run typecheck test --filter=@bb/agent-runtime --filter=bb-plugin-provider-claude-code --continue --force passed both typechecks, 22 agent-runtime files / 319 tests, and 25 Claude files / 357 tests.
• After the rebase, pnpm exec turbo run test:integration --filter=@bb/agent-runtime --force passed 9 files and 64 tests, including the refreshed live Claude coverage.
• pnpm parity --old <dbc16017c9 checkout> --new . --allowlist <empty external allowlist> (48 passed, 0 failed, 4 process-only cells skipped)
• Ran scripts/bb-dev-app current, installed a throwaway path plugin, and verified Claude Code, Codex, and ACP Cursor received the marker, secret, and loopback-expanded URL while the event masked the secret.
• Reloaded the plugin with a changed marker and verified the same Claude provider session preserved context, observed the new environment, and displayed the required rebuild note. Captured and attached a real UI screenshot plus a redacted e2e report to BB-89.

Fixes BB-89

AGENT GENERATED