feat(agent): add provider templates

Assisted-by: Codex

docs/prds/0026-agent-provider-templates.md

@@ -6,7 +6,7 @@
 
 ## Summary
 
-Support multiple agent harnesses, starting with Codex and Claude, while keeping agent files provider-agnostic and bottle files responsible for boundaries.
+Support Claude and Codex agent providers while keeping agent files provider-agnostic and bottle files responsible for boundaries.
 
 ## Problem
 
@@ -22,7 +22,7 @@ Today claude-bottle is hard-wired around Claude Code assumptions. When Claude ru
 
 ## Non-goals
 
-- Do not implement support for additional harnesses such as `pi`, `aider`, or other future providers.
+- Do not implement support for providers beyond Claude and Codex.
 - Do not move security boundaries into agent files.
 - Do not allow custom Dockerfiles to remove or bypass required claude-bottle infrastructure.
 - Do not add new runtime dependencies unless the existing Docker/Codex tooling cannot satisfy the minimum cut.
@@ -82,8 +82,8 @@ agent_provider:
 
 ## Open questions
 
-- What is the exact Codex auth role name and environment-variable contract?
-- Which state-folder artifacts are Claude-specific today, and which are provider-neutral?
+- The initial Codex auth role is `codex_auth`; it provides a non-secret `OPENAI_API_KEY` placeholder to the agent while egress holds the real token.
+- Existing state-folder transcript capture is Claude-specific and should remain gated to Claude until the follow-up state/transcript refactor.
 
 ## References