fix(agent): recover stale runs and improve new-user OA delivery

Fix DEV logout cookie clearing, materialize selected MindSpace OA assets before agent runs, and recover zombie runs from synced workspace pages. Add client run wait timeout, harness retry limits, page-edit asset forwarding, and logout/john2 scenario tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

agent-run-routes.test.mjs

@@ -746,3 +746,46 @@ test('GET /agent/runs/:runId/events republishes changed run state before termina
   assert.match(output, /"status":"succeeded"/);
   assert.deepEqual(dispatched, ['run-2']);
 });
+
+test('POST /agent/runs materializes selected assets before creating run', async () => {
+  const materialized = [];
+  const handler = createPostAgentRunsHandler({
+    userAuth: {
+      async ownsSession() {
+        return true;
+      },
+    },
+    mindSpaceAssetAgent: {
+      async materializeAssetsForSession(payload) {
+        materialized.push(payload);
+        return { materialized: [{ relativePath: 'oa/sales.xlsx' }] };
+      },
+    },
+    agentRunGateway: {
+      async createRun(userId, payload) {
+        return { id: 'run-1', status: 'queued', userId, payload };
+      },
+    },
+  });
+  const res = createResponseRecorder();
+
+  await handler(
+    {
+      currentUser: { id: 'user-1' },
+      body: {
+        session_id: 'session-1',
+        request_id: 'req-1',
+        user_message: { role: 'user', content: [{ type: 'text', text: 'analyze' }] },
+        selected_asset_ids: ['asset-9'],
+      },
+    },
+    res,
+  );
+
+  assert.equal(res.statusCode, 202);
+  assert.deepEqual(materialized, [{
+    sessionId: 'session-1',
+    userId: 'user-1',
+    assetIds: ['asset-9'],
+  }]);
+});