Run post-start hooks after workspace provisioning

[ESultanik]

Run post_start after agent bootstrap, copied or cloned workspace provisioning, and additional mounts. Refresh proxy credentials before invoking the hook so it can use project files and the current capability token during creation and reprovisioning. Check for pending cancellation before preparing the hook session. Hook failures remain warnings.

Integration assertions cover copied and cloned workspaces with additional mounts, plus mount-only instances. The mount-only assertion reads a unique marker written by the startup hook, so later synchronization cannot hide incorrect hook ordering. Update the lifecycle and testing references to match.

Closes #511.

Validation after merging main at bd24c7cf6bfef9d59f702edaeaa466cd29a66c53: 1,195 coop unit tests, one setup-policy integration test, 30 proxy unit tests, and eight proxy integration tests passed. Workspace clippy with warnings denied, format, TOML formatting, and applicable pre-commit checks passed. The isolated SIGTERM regression fails at the expected assertion when the cancellation check is deliberately removed. The existing mutation exclusions are unchanged; their rationale now describes each helper. Dependency policy passed with existing duplicate-version warnings.

Focused Lima post-start validation on this candidate: five passed, zero failed, zero skipped. Firecracker integration and the full VM suites were not rerun for this final cancellation/doc fix; the new portable unit test runs in ordinary Linux PR CI and passed locally on macOS. The local Linux test VM is unavailable.

Focused validation of the new explicit --mount fixture: Lima two passed, zero failed, zero skipped. Firecracker post-start group five passed, zero failed, zero skipped. Deliberately moving only the mount-only hook before sync_mounts produced four passed and one failed: the exact new marker assertion. The existing copied-workspace and warn-and-continue assertions remained green, demonstrating that the new witness detects the previously uncovered ordering regression.

Earlier full platform validation at d7f7309923c423e23c68f3ac9cdc81fa63651b3a: Lima 490 passed, zero failed, 13 skipped; Firecracker 499 passed, zero failed, nine skipped, plus the privileged disk regression. An initial hosted attempt had an SSH readiness timeout; its single unchanged-candidate retry passed. The nested local Linux attempt also had SSH readiness failures and is not counted as a pass. Those full runs preceded the latest-main merge; the mount-only review fix received focused backend verification.

[ESultanik]

Merge/readiness checklist for this PR:

Stack order: #512 → #513 → #514 → #516. Each PR should ultimately merge into main, in that order; do not merge a follow-on PR into its current feature-branch base.

After a predecessor merges, retarget the next PR to main (verify the base even if GitHub updates it automatically). Integrate main with a merge commit if needed, resolve conflicts, and check that the final diff contains only that PR's intended change. Preserve published history: no force-push/rebase is needed. Refresh required CI and review; repeat validation affected by any changes to the tested tree.

• Merge Fix macOS test fixtures for paths and disk rollback #512, then retarget this PR from fix/macos-test-fixtures to main.
• Complete Firecracker VM integration for this PR's candidate and record the results below.
• Confirm the final diff, required CI, and maintainer review; mark ready once the platform gate passes, then merge into main.
• After merging, retarget Copy configured guest files before agent bootstrap #514 to main.

Current evidence: full Lima integration passed with 494 passed, zero failed, and nine skipped; workspace checks and Linux CI are green. Firecracker VM integration has not run because a test host has not been supplied. The draft state records that missing gate.

Use a clean checkout of this PR's final candidate and a Linux SSH host with working KVM/Firecracker access and the remote full-suite prerequisites. The full run needs the documented build/network tools and passwordless sudo. Run these suites serially on a shared host because they rebuild shared test images.

git rev-parse HEAD
./tests/run-integration.sh --full --remote user@host --name coop-pr-513

Replace user@host with the available test host. Confirm that the copied- and cloned-workspace post-start ordering regressions execute and pass.

Post the tested commit SHA, host architecture, runner exit status, pass/fail/skip counts, and a log link or attachment here. Inspect skipped phases; a zero exit alone is insufficient if relevant coverage was skipped. Linux CI does not substitute for Firecracker VM integration. A run of #516 alone provides combined-stack evidence, not proof that each earlier PR's exact candidate was tested.

[hbrodin]

Looks good to me. The inline suggestions are optional; leaving merge timing to Evan.