Run the agent loop on every provider, not just API keys

The loop was gated to API-key providers, so a GPT-account (Codex) CEO failed
with 'requires an API-key provider'. Port Pi's actual request handlers natively
so every agent-capable provider runs:
- chat-completions turn for xAI, Groq, Mistral, Cerebras, OpenRouter
- Codex SSE Responses for GPT account
- Anthropic-OAuth (Claude Code system + beta headers) for Claude Pro/Max
- Copilot proxy (baseUrl from the token) for GitHub Copilot
- Gemini Code Assist for Google Antigravity

A credential resolver refreshes expired OAuth access tokens at request time and
persists the rotation; the runner routes by provider key and passes the resolved
credential. The heartbeat now retries failed tasks (bounded to 3 attempts) so a
run that failed on the old gate recovers automatically. Cloud providers
(Azure/Bedrock/Vertex) still report a clear unsupported message.

AgentCompany-New/src/main/services/task-execution-service.ts

@@ -332,7 +332,8 @@ export class TaskExecutionService {
         and a.heartbeat_enabled = 1
         and a.lifecycle = 'active'
         and p.enabled = 1
-        and not exists (select 1 from task_runs r where r.task_id = t.id)
+        and not exists (select 1 from task_runs r where r.task_id = t.id and r.state in ('queued', 'running', 'completed'))
+        and (select count(*) from task_runs r where r.task_id = t.id) < 3
     `).all() as Array<{ task_id: string; org_id: string }>;
     const created: string[] = [];
     for (const row of rows) {