chore: drop leftover T3 tooling names and unused root folders - #661

…#665)

GOAT has no computer use. Upstream T3 Code has an open, unmerged Cua Driver stack by Julius Marminge (rebuilt from his #16527) that adds verified distribution, an opt‑in server lifecycle, an Electron host, and packaging, and attaches nothing to agents. This PR ports its server half, [pingdotgg/t3code#21694](pingdotgg/t3code#21694) at frozen head `b8569ac92` and [#21695](pingdotgg/t3code#21695) at `dc307c8a7`, pins Cua Driver 0.37.0, and forces the driver's telemetry and update check off. Computer use stays off by default (`enableCua: false`), and no provider or UI uses it yet.

The first two commits are the upstream PRs applied as diffs, authored by Julius with the upstream commit list in each message. Desktop hosting and packaging follow in the stacked PR feat/cua-driver-desktop.

## GOAT deltas from upstream

- **Pin 0.37.0** (upstream pins 0.34.1). `@trycua/cua-driver` on npm stops at 0.37.0, and the SDK and executable must share a version. Archive names, byte sizes and SHA‑256 come from the official `cua-driver-rs-v0.37.0` `SHA256SUMS` (re‑downloaded and compared). All six platform/arch entries match the downloaded archives and contain every required companion file. The 0.37.0 embedded host API is identical to 0.34.1's, so no ported logic changed.
- **Telemetry and update check off at the daemon.** The host is built with `EmbeddedCuaDriverHost.withOptions(cuaDriverHostOptions(...))`, passing `CUA_DRIVER_RS_TELEMETRY_ENABLED=false`, `CUA_TELEMETRY_ENABLED=false` and `CUA_DRIVER_RS_UPDATE_CHECK=false`. The 0.37.0 host clears the daemon environment and **rejects** names outside its allowlist (`allowed_environment_name` in `cua-driver-sdk/src/embedded.rs`), so `DO_NOT_TRACK` and `CUA_TELEMETRY` cannot be passed there; trying makes host construction fail. This differs from plan D4's four‑variable list on purpose.
- **Opt‑outs on the agent path.** The MCP descriptor that providers will spawn (`cua-driver mcp --embedded …`) is a separate driver process outside that allowlist, and upstream returns it with an empty environment. `CuaDriver.acquire` now adds all five opt‑outs (`withCuaDriverPrivacyEnvironment`), overriding any value the native descriptor carries.
- **Renames** via `node scripts/goat-rename.ts --apply`: `@goat/*` imports, `GOAT_CUA_DRIVER_PATH`, `goat/cua/*` service keys, temp prefix. The standalone host identity is `si.goat.server` (upstream `com.t3tools.t3code.server`; `os-identities` keeps `com.t3tools` only for installed OS services).
- **`server.ts`**: the runtime layer `pipe` already had 20 steps, its maximum, so `layerCuaDriver` joins the existing `ProjectStore`/`ThreadSearch` merge. Upstream's separate step fails typecheck in GOAT (TS2554).
- **Merged with dev `881757889`** (after the upstream chase #658). `server.ts`, `packages/shared/package.json` and `third-party-licenses.config.json` take dev's versions plus this PR's additions. `pnpm-lock.yaml` differs from dev only in `@trycua`/`@ubjs` entries, and `vp i --frozen-lockfile` passes.
- **Docs**: ADR‑0020 (`structure/decisions/ADR-0020-cua-driver-computer-use.md`), a "Computer use" section in `structure/server.md`, the shared export row, manifest and INDEX rows, and fork‑delta area `cua-driver` (`devlog/_chase/scan.sh --delta` ok).

## Verification

Real macOS 26 (arm64), official 0.37.0 universal binary:

- **Daemon env.** I started the host through the SDK using the shared options, with a hostile parent env (`CUA_DRIVER_RS_TELEMETRY_ENABLED=true`, `CUA_DRIVER_RS_UPDATE_CHECK=true`) and an isolated HOME. `ps -E` on the live daemon showed all three switches `=false` and `--host-bundle-id si.goat.server`. Under that env, `cua-driver telemetry status --json` reports `enabled: false, source: environment` (baseline without overrides: `enabled: true, source: default`). The isolated HOME held no installation ID or telemetry markers afterwards. 0.37.0's `get_config` does not report telemetry state, so this check relies on the process env plus `telemetry status`.
- **Agent path.** I spawned the MCP proxy from the published descriptor: 62 tools listed over stdio (same count as upstream's Linux run), proxy env holds all five opt‑outs, and `telemetry status` under them reports `source: do_not_track`.
- **Production standalone path.** `makeCuaDriverInstallation` + `FetchHttpClient` downloaded the 0.37.0 darwin archive from GitHub, verified size and SHA‑256, and published `tools/cua-driver/0.37.0` with exactly the five expected files in 1.6 s; cache reuse took 1 ms. `makeStandaloneHostFactory` with the real SDK then started and stopped the host. Upstream only qualified this path on Linux. This was a temporary test file, not committed.
- `vp test run src/cua src/resourceTelemetry` (apps/server): 80/81. The one failure, `HostResources publishes load and disk`, is darwin‑only on dev: `diskPathForPlatform("darwin")` returns `$HOME` while the test expects `/`; neither file differs from dev, and CI runs Linux. `vp test run src/telemetry` (apps/desktop): 5/5. `vp test run src/settings src/resourceTelemetry` (packages/contracts): 198/198.
- Red→green: emptying the host option environment fails `starts an explicit driver path with telemetry and update checks off`; restoring it passes. The existing lifecycle tests now assert the exact five‑variable descriptor, with a hostile `CUA_TELEMETRY=1` in the native fixture.
- Typecheck exits 0 for apps/server, apps/desktop, packages/shared and packages/contracts (only pre‑existing Effect suggestions remain). Targeted `vp lint` and `vp fmt --check` pass on touched files; `server.ts:944` has a pre‑existing warning.

## Platform notes (re‑verified from 0.37.0)

- **Windows UAC.** `cua-driver.exe` and `cua-driver-uia.exe` embed `requestedExecutionLevel level="asInvoker"`, so neither prompts on launch. `install.ps1` installs under `%LOCALAPPDATA%` without elevation and prompts only for its optional `-AutoStart` scheduled task, which GOAT never uses. Unelevated, the driver refuses elevated targets and may see truncated UWP/AppContainer UIA trees. Not run on a real Windows host (`win` was unreachable).
- **Linux arm64.** Ships native aarch64 builds of the driver and SDK library (glibc ≥ 2.30, same floor as x64). The installer maps `Linux-aarch64`, and the release notes label all Linux builds "preview". A read‑only probe of an arm64 Ubuntu 24.04 host (glibc 2.39) found it compatible, but it is headless; I did not run the driver there.

- **goat-ci** on head 5ef6fbc (after merging dev 10 commits past 8817578, including #661): [pull_request run 39591463869](https://github.com/goat-si/goat/actions/runs/39591463869) and [full dispatch run 39591455467](https://github.com/goat-si/goat/actions/runs/39591455467), both 18/18 jobs with goat-ci-result success. The previous head a1340bf was green on both runs (39574338635, 39574407950).

## Not run / open

- Windows and Linux runtime with this pin, macOS TCC attribution, packaged desktop (next PR plus lane 3). No GUI capture or input was exercised.
- The driver's `check_for_update` MCP tool still contacts GitHub when an agent calls it. Removing it belongs to the capability ceiling in the safety lane; ADR‑0020 records it as pending.
- **Overlaps:** #661 edits `devlog/_chase/010_fork_delta.md` and goat‑rename rules (this adds one block in its own alphabetical slot; re‑run `goat-rename --check` after #661). #659 edits `third-party-licenses.config.json` (this keeps upstream's two Cua package overrides). #658 is the upstream chase; nothing here comes from upstream main. `structure/INDEX.md` already drifts from its manifest on dev (iMessage rows, two scopes); this PR adds only its own three rows.

## Review

Independent read-only review by Codex gpt-6.1-sol. Round 1 returned MUST-FIX with three findings: unrelated lockfile peer re-resolution, docs describing the desktop host as current at this layer, and the ADR commit citation. All three are fixed in `8573ccbfb`. Round 2 returned PASS. Neither round found a runtime defect.

Implementation: anthropic/claude-opus-5-5 via the Codex harness in GOAT (lane 1 of the Cua Driver program). Upstream implementation credit: Julius Marminge (pingdotgg/t3code #16527, #21694, #21695).