…loud#1097)

* fix(llm-cli): address post-review issues in CLI integration

- fix: set os.environ[env_key] after sync_env_values so in-process retry
  loop sees the user-provided binary path immediately (Tracer-Cloud#781 follow-up)
- fix: validate user-supplied binary path (isfile + executable) before
  persisting to .env to prevent silently storing broken paths
- fix: bump npm_prefix_bin_dirs subprocess timeout from 0.3s to 2.0s to
  avoid false-empty cache on slow nvm/volta shim startup
- refactor: use None sentinels for resolve_cli_binary defaults so
  shutil.which and is_runnable_binary are looked up at call time, making
  the function patchable in tests without explicit overrides
- refactor: drop redundant shutil import and explicit which_resolver /
  runnable_check kwargs from CodexAdapter._resolve_binary
- refactor: consolidate four separate binary_resolver import blocks into one
- fix: _ver_tuple now uses re.findall to correctly parse versions with
  non-digit segments (e.g. "1.2a.3", "1.2.3-beta.4")
- feat: log CLI stderr at DEBUG level after successful parse so warnings
  from the CLI are not silently discarded
- test: update patch targets from codex.shutil.which to
  binary_resolver.shutil.which after resolution moved to shared module

* docs(llm-cli): document auth probe pattern and env allowlist in AGENTS.md

- Add three-state logged_in contract table (True/False/None) with wizard behaviour
- Document _classify_*_auth pattern and negative-phrases-first rule
- Warn about _SAFE_SUBPROCESS_ENV_PREFIXES coupling in runner.py for new CLIs
- Update provider checklist with auth probe and env forwarding steps

* fix(llm-cli): use is_runnable_binary for path validation on all platforms

Replace os.path.isfile + os.access(X_OK) with shared is_runnable_binary
from binary_resolver, which already handles Windows extension checks
(.cmd, .exe, .ps1, .bat). os.access(X_OK) returns False for valid
Windows executables that lack Unix-style execute bits.

* fix(llm-cli): diagnose broken symlinks in binary path resolution

- add diagnose_binary_path() to binary_resolver: distinguishes broken
  symlinks (with target path in message) from missing files and
  non-executable files, returning an actionable string or None
- resolve_cli_binary now logs a WARNING with the diagnostic when an
  explicit *_BIN env var is set but unusable, instead of silently
  falling through to PATH lookup
- wizard flow uses diagnose_binary_path so users see e.g. "'~/bin/codex'
  is a broken symlink (points to '/usr/local/bin/codex'). Remove or fix it."
  instead of the generic "not a valid executable" message
- tests: missing file, broken symlink, valid exe, non-executable,
  and resolver warning on broken symlink

* docs(llm-cli): add module docstring with path-state table to binary_resolver

- document resolve_cli_binary, diagnose_binary_path, and is_runnable_binary
  at the top of binary_resolver.py with path state -> message reference table
  and platform notes (Windows extension check, lru_cache, readlink fallback)
- move inline `import sys` and `import logging` to top-level in test file
- guard symlink-creation tests against Windows hosts without elevation:
  catch OSError/NotImplementedError and skip rather than fail, preserving
  full coverage on Linux/macOS CI and graceful no-op on restricted runners

* fix(tests): tighten chmod masks for CodeQL

- set executable test fixture permissions to 0700
- set non-executable test fixture permissions to 0600

* fix(llm-cli): align windows diagnostics and onboarding test

- add Windows executable extension validation in diagnose_binary_path
- expand binary_resolver docstring path-state table for Windows mismatch case
- harden onboarding path override test with real executable and env cleanup
- assert in-process CODEX_BIN propagation without leaking env across tests

* style(llm-cli): format binary_resolver for CI

- reformat Windows executable diagnostic branch to satisfy ruff format-check

* feat(llm-cli): add CLI registry and generic wizard summary

- add registry mapping LLM_PROVIDER to adapter factory and model env key
- wire _create_llm_client through registry instead of codex-only branch
- derive saved-summary credential line from adapter auth_hint
- drop unused prompt_delivery from LLMCLIAdapter; document prompt via build()
- update AGENTS.md wiring checklist; add registry and summary tests

* fix(llm-cli): lazy-load CLI registry to break import cycle

- defer get_cli_provider_registration import until _create_llm_client runs
- avoid loading llm_cli package __init__ (runner) during llm_client import