chore(go): audit providers kimi grok qwen letta

Move Kimi, Grok, and Qwen onto managed_runtime.go and shell_command.go;
share the encoded and shell command builders and the quoted Windows
legacy parser with Droid; split managed_changes.go; dedupe Letta's hook
entry filtering and stop swallowing settings read errors.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

cmd/elydora/plugins/managed_runtime.go

@@ -1,9 +1,7 @@
 package plugins
 
 import (
-	"encoding/json"
 	"fmt"
-	"os"
 	"path/filepath"
 	"runtime"
 	"sort"
@@ -30,6 +28,14 @@ type managedScriptReference struct {
 	scriptPath string
 }
 
+func stringSet(values ...string) map[string]struct{} {
+	result := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		result[value] = struct{}{}
+	}
+	return result
+}
+
 var managedRuntimeConfigFields = stringSet(
 	"org_id", "agent_id", "kid", "base_url", "token", "agent_name",
 )
@@ -65,24 +71,28 @@ func managedReferenceKey(agentID string) string {
 	return agentID
 }
 
-// resolveManagedScript accepts absolute ~/.elydora/<agent>/<scriptName> paths.
-func resolveManagedScript(scriptPath, scriptName string) (*managedScriptReference, error) {
+// managedScriptWithin accepts absolute <runtimeRoot>/<agent>/<scriptName> paths.
+func managedScriptWithin(scriptPath, scriptName, runtimeRoot string) *managedScriptReference {
 	if !filepath.IsAbs(scriptPath) || !sameManagedName(filepath.Base(scriptPath), scriptName) {
-		return nil, nil
+		return nil
 	}
 	agentDirectory := filepath.Dir(scriptPath)
+	if !sameManagedPath(filepath.Dir(agentDirectory), runtimeRoot) {
+		return nil
+	}
+	agentID := filepath.Base(agentDirectory)
+	if agentID == "" || agentID == "." || agentID == ".." {
+		return nil
+	}
+	return &managedScriptReference{agentID: agentID, scriptPath: scriptPath}
+}
+
+func resolveManagedScript(scriptPath, scriptName string) (*managedScriptReference, error) {
 	runtimeRoot, err := AgentRuntimeRoot()
 	if err != nil {
 		return nil, err
 	}
-	if !sameManagedPath(filepath.Dir(agentDirectory), runtimeRoot) {
-		return nil, nil
-	}
-	agentID := filepath.Base(agentDirectory)
-	if agentID == "" || agentID == "." || agentID == ".." {
-		return nil, nil
-	}
-	return &managedScriptReference{agentID: agentID, scriptPath: scriptPath}, nil
+	return managedScriptWithin(scriptPath, scriptName, runtimeRoot), nil
 }
 
 func validateManagedInstallConfig(config InstallConfig, agentKey, product string) error {
@@ -401,89 +411,3 @@ func managedRuntimeFilesPresent(contracts []managedRuntimeContract, agentKey str
 	}
 	return false, nil
 }
-
-func buildManagedRuntimeConfig(config InstallConfig, agentKey string) ([]byte, error) {
-	value := map[string]any{
-		"org_id": config.OrgID, "agent_id": config.AgentID, "kid": config.KID,
-		"base_url": config.BaseURL, "agent_name": agentKey,
-	}
-	if config.Token != "" {
-		value["token"] = config.Token
-	}
-	encoded, err := json.MarshalIndent(value, "", "  ")
-	if err != nil {
-		return nil, fmt.Errorf("encode Elydora runtime config: %w", err)
-	}
-	encoded = append(encoded, '\n')
-	if len(encoded) > maxRuntimeConfigBytes {
-		return nil, fmt.Errorf(
-			"elydora runtime config exceeds %d bytes after JSON encoding",
-			maxRuntimeConfigBytes,
-		)
-	}
-	return encoded, nil
-}
-
-// managedRuntimeFileChanges prepares the guard, config, key, and audit runtime changes.
-func managedRuntimeFileChanges(
-	config InstallConfig,
-	paths *managedRuntimePaths,
-	agentKey, guardScript, auditScript string,
-) ([]*fileChange, error) {
-	runtimeConfig, err := buildManagedRuntimeConfig(config, agentKey)
-	if err != nil {
-		return nil, err
-	}
-	items := []struct {
-		path, label string
-		content     []byte
-		mode        os.FileMode
-	}{
-		{paths.guardPath, "Elydora guard runtime", []byte(guardScript), 0700},
-		{paths.configPath, "Elydora runtime config", runtimeConfig, 0600},
-		{paths.keyPath, "Elydora private key", []byte(config.PrivateKey), 0600},
-		{paths.auditPath, "Elydora audit runtime", []byte(auditScript), 0700},
-	}
-	changes := make([]*fileChange, 0, len(items)+1)
-	for _, item := range items {
-		change, err := prepareFileChange(item.path, item.label, item.content, item.mode)
-		if err != nil {
-			return nil, err
-		}
-		changes = append(changes, change)
-	}
-	return changes, nil
-}
-
-func hasFileChanges(changes []*fileChange) bool {
-	for _, change := range changes {
-		if change != nil {
-			return true
-		}
-	}
-	return false
-}
-
-// writeManagedChanges creates the runtime and settings directories, then commits.
-func writeManagedChanges(
-	changes []*fileChange,
-	label string,
-	rename renameFunc,
-	runtimeRoot, agentDirectory, settingsDirectory, settingsLabel string,
-) error {
-	if !hasFileChanges(changes) {
-		return nil
-	}
-	if agentDirectory != "" {
-		if err := EnsurePrivateDirectory(runtimeRoot); err != nil {
-			return err
-		}
-		if err := EnsurePrivateDirectory(agentDirectory); err != nil {
-			return err
-		}
-	}
-	if err := ensureManagedDirectory(settingsDirectory, settingsLabel); err != nil {
-		return err
-	}
-	return writeChanges(changes, label, rename)
-}