NewVCSMatcher used git.PlainOpen only to locate the worktree root, but
importing the top-level go-git package links its whole object/transport
stack (ssh, packfile, merkletrie, ...) into anything that touches the
permission checker - i.e. every embedder of pkg/runtime.

Locate the root by statting basePath/.git directly (PlainOpen did not
search parent directories either; a gitfile still counts for linked
worktrees) and read patterns via the lightweight
plumbing/format/gitignore package over an osfs, exactly as before.

pkg/session mixed the in-memory store with the file-backed constructor,
so every embedder of pkg/runtime linked modernc.org/sqlite (large and
slow to compile) even when using purely in-memory sessions.

session.NewSQLiteSessionStore(ctx, path) becomes sqlitestore.New(ctx,
path); behavior (open, migrate, backup+retry recovery) is unchanged.
SQLiteSessionStore, NewSQLiteSessionStoreFromDB and the migrations stay
in pkg/session - they only use database/sql and don't drag the driver.

BREAKING CHANGE: callers of session.NewSQLiteSessionStore must import
github.com/docker/docker-agent/pkg/session/sqlitestore and call New.

…t package

pkg/runtime and pkg/agent imported pkg/tools/mcp for a handful of small
helpers, linking the entire MCP toolset - and through it expr-lang/expr
(via toolinstall) and goja (via pkg/js) - into every embedder, even ones
with zero MCP toolsets.

- Move the interactive-prompt gating helpers, OAuth sentinel errors and
  PromptInfo/PromptArgument to pkg/tools; pkg/tools/mcp keeps aliases
  and forwarders so its public API is unchanged.
- Move the OAuth authorization-code flow (PKCE/state, callback server,
  token exchange/refresh, dynamic client registration) to the new leaf
  pkg/tools/mcp/oauthflow, again with aliases and forwarders; only the
  upstream-header-scoping transport stays in pkg/tools/mcp.
- Runtime prompt discovery now goes through a small mcpPromptToolset
  interface (satisfied by *mcp.Toolset) instead of a concrete type
  assertion.

pkg/runtime imported pkg/js solely to expand ${...} expressions in
slash-command instructions, linking the goja JavaScript engine into
every embedder of the runtime.

ResolveCommand now goes through a registered CommandEvaluator factory.
The new pkg/runtime/jscommands package registers the goja-backed
evaluator on import and is blank-imported by teamloader, the CLI and
embeddedchat/defaults, so every YAML/CLI path behaves exactly as
before. Code-built embedders that want JS command expressions opt in
with the same blank import; without it, ${...} is left unexpanded with
a warning pointing at the import.

Assert via go list -deps that the packages a code-built embedder links
(runtime, agent, team, session, tools, anthropic provider) stay free of
goja, expr, the OpenAI SDK, full go-git, the SQLite driver, pkg/js,
pkg/tools/mcp and toolinstall, so the import-graph cuts don't silently
regress. Also migrate e2e tests to sqlitestore.New.

golangci-lint's nolintlint flags it as unused; json.Marshal of the
token cache no longer trips gosec.

os.Rename replaces the destination, so a second migration failure
clobbered the .bak from the first one - the last known-good copy of the
user's sessions. When .bak already exists, move the broken database
aside under a timestamped name instead.

- Cap non-200 response body reads at 512 bytes before embedding them in
  errors: OAuth error bodies come from the remote endpoint and end up
  in logs, so a bound keeps a hostile or misconfigured server from
  stuffing megabytes (or sensitive fields) into them.
- Use a comma-ok assertion on http.DefaultTransport so a replaced
  transport (test helper, proxy shim) degrades to a fresh default
  instead of panicking.