fix(agent): recover stale runs and improve new-user OA delivery

Fix DEV logout cookie clearing, materialize selected MindSpace OA assets before agent runs, and recover zombie runs from synced workspace pages. Add client run wait timeout, harness retry limits, page-edit asset forwarding, and logout/john2 scenario tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

user-auth.test.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 import { Algorithm as Argon2Algorithm, hashRawSync as argon2HashRawSync } from '@node-rs/argon2';
-import { createUserAuth } from './user-auth.mjs';
+import { createUserAuth, clearUserLogoutCookies, userLoginCookies } from './user-auth.mjs';
 
 function hashPasswordPbkdf2(password, salt) {
   return crypto.pbkdf2Sync(password, salt, 100000, 64, 'sha512').toString('hex');
@@ -728,3 +728,22 @@ test('upsertWechatAgentRoute uses atomic insert-on-duplicate semantics', async (
   assert.match(calls[0][0], /ON DUPLICATE KEY UPDATE/);
   assert.equal(calls.some(([sql]) => /UPDATE h5_wechat_agent_routes/.test(sql)), false);
 });
+
+test('clearUserLogoutCookies clears shared-domain and host-only cookies', () => {
+  const cookies = clearUserLogoutCookies(false, '.tkmind.cn');
+  assert.equal(cookies.length, 2);
+  assert.match(cookies[0], /tkmind_user_session=/);
+  assert.match(cookies[0], /Domain=\.tkmind\.cn/);
+  assert.match(cookies[0], /Max-Age=0/);
+  assert.match(cookies[1], /Max-Age=0/);
+  assert.doesNotMatch(cookies[1], /Domain=/);
+});
+
+test('userLoginCookies and clearUserLogoutCookies are symmetric for shared domain', () => {
+  const login = userLoginCookies('token-abc', true, '.tkmind.cn');
+  const logout = clearUserLogoutCookies(true, '.tkmind.cn');
+  assert.equal(login.length, 2);
+  assert.equal(logout.length, 2);
+  assert.match(login[1], /Max-Age=0/);
+  assert.match(logout[1], /Max-Age=0/);
+});