Add opt-in bundled Goose runtime for macOS

[salman1993]

Summary

Add Goose (bundled) as an opt-in local runtime for internal macOS builds. Keep existing Goose unchanged and Buzz Agent as the default. No saved agents are migrated.

Build goose-acp from a pinned upstream commit using the lean profile with native TLS and keyring support. Resolve the bundled executable from the app, and accept build-supplied provider/model defaults below explicit user choices. Model discovery preserves the configured default until the user chooses another model. Remote deployment is rejected for this local-only pilot.

The existing Goose configuration and credential locations are shared. This pilot does not establish parity for upstream shell cancellation or output limits.

Related issue

Related to #7742

Testing

Onboarding screenshot showing both Goose choices.

• just bundled-goose: built the pinned Apple Silicon artifact, about 15 MiB; only system dynamic-library dependencies.
• With BUZZ_TEST_GOOSE_ACP set to the staged binary and BUZZ_TEST_BIN_DIR set to the built Buzz binaries, cargo test -p buzz-acp real_goose_native_git_shell -- --ignored --nocapture passed. The real Goose process used a scripted local provider and verified signed commits/tags, identity, credential scope, and key cleanup.
• BUZZ_BUILD_BUNDLED_GOOSE_PROVIDER=databricks_v2 BUZZ_BUILD_BUNDLED_GOOSE_MODEL=goose-gpt-5-6-sol cargo test --manifest-path desktop/src-tauri/Cargo.toml --features bundled-goose --lib passed. Focused regressions also cover settings-display precedence for explicit and inherited model/provider choices.

The model-discovery regression was reproduced locally before the fix: a competing catalog entry replaced the bundled default. The strengthened test waits for that entry to appear before checking the default. All 27 onboarding tests and the full local just ci gate passed after the fix.

Signed app packaging, Intel macOS, and live Databricks/relay use still need qualification in the internal build.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is d01e5f82058463709a22e93bb4cd795da5f53e10...48c13b5ac9a7fbb6654eecb34f0a50bf2f220f18.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 48c13b5ac9a7fbb6654eecb34f0a50bf2f220f18 to authorize a new review.
Any previous review applies only to its recorded range.

[salman1993]

🤖 Screenshot from the bundled-Goose onboarding test.

Opt-in harness choice

Both Goose options are available, and Buzz remains recommended.