[hongkongkiwi]

What and why

Fixes #220

Settings → Providers offered an executable location override for 16 agents, but the three first-party harnesses (Claude Code, Codex, Kimi Code) had no card and no override, so a CLI outside the standard locations could not be pointed at. This change:

• validated_executable in provider_settings.rs now accepts every provider in providers::PROVIDERS (via the same known_provider check the per-provider environment variables already use) instead of a duplicated 16-id literal, so the gate cannot drift when harnesses are added.
• The Claude Code card gains an executable form; Codex and Kimi Code get their own cards (sign-in summary, docs link, executable form, per-provider environment editor), matching the existing card pattern.
• Leaving a location empty still restores automatic discovery; saving, validation (absolute, existing, executable file) and cache invalidation flow through the unchanged provider_set_executable IPC.
• Warm agents now include the resolved executable in their adoption key (next to the existing environment fingerprint), so a saved override applies to the very next turn of a warm task instead of up to 10 minutes later.
• Docs: docs/providers.md drops the "harnesses without a card" sentence, docs/settings.md no longer says executable paths are limited to OpenCode or Antigravity, and the warm-adoption list in AGENTS.md gains the executable.

How it was tested

• npx tsc --noEmit — clean.

• cargo test --manifest-path src-tauri/Cargo.toml --lib filters: provider_settings 19 passed (includes the updated allowlist test), warm 4 passed, connections 5 passed.

• PW_PORT=1439 npx playwright test tests/provider-settings.spec.ts tests/grok.spec.ts — 42 passed in Chrome: hydration of the three new forms, save round-trip, and the preview grouping test.

• npm test — 201 passed; the 4 failures are pre-existing on unmodified main (3 bundle tests need a prior npm run build, which a fresh worktree has not run; 1 tool-cards date-format test fails on main too). provider-settings.ts is a lazy-loaded chunk, so the entry startup budget is untouched.

• WebKit run is left to CI.

• npm run build (typecheck + bundle)

• npm test

• cargo test --manifest-path src-tauri/Cargo.toml --lib provider_settings / warm / connections (if Rust changed)

• Relevant Playwright tests in Chrome (WebKit left to CI)

Checklist

• Commit messages follow <type>: <description>
• Docs in docs/ updated if behavior changed
• Preview mocks added in src/preview.ts for new IPC commands (none added; existing mocks cover the unchanged IPC)
• No telemetry, secrets or personal paths added