[AIGTWY-4882] Add fresh-launch journeys and dedicated CUJ7 coverage

[tt-le]

Summary

Add fresh-launch journeys and dedicated CUJ7 model discovery/inference coverage. Tracks AIGTWY-4882.

• Keep fresh --workspace file tasks and --provider launch checks in the Full agent suites. Provider cases consume existing services and do not perform inference.
• Add five CUJ7 journeys / eight collected cases: configured Claude picker discovery, configured Codex app-server discovery, fresh scoped file tasks for both agents, and preservation of preexisting Claude OS-managed family defaults during explicit model selection.
• Exercise Claude's UG-owned --model before -- and native argument forwarding after it. Codex covers model flags before the separator and within native exec. Require completed file answers and model attribution, not just startup or routing banners.
• Rebase onto [AIGTWY-4972] Consolidate CUJ helpers, fix flakes, parallelize CUJs #1040 and reuse its shared bearer, cleanup, served-response checks, and absolute-path Claude prompts. test_cuj7_model_discovery.py defines CUJ_NAME, so automatic CI discovery runs it as E2E CUJs · CUJ 7 · Unmanaged model discovery without workflow changes.
• Keep CUJ7 sessions function-scoped for fresh-launch coverage; the shared class fixture requires a published config, while this workspace must remain unmanaged. Preserve existing test names. No production changes, fixture provisioning, or remote configuration mutations.

Workspace prerequisites

CUJ7 is pinned to https://dbc-14e376e8-6541.cloud.databricks.com (workspace 7474651332480761). It must publish no CodingAgentConfig, expose discoverable system.ai models, and retain ug_e2e.models.claude_haiku, ug_e2e.models.claude_sonnet, and ug_e2e.models.gpt_luna.

The shared UG_CUJ_SP_CLIENT_ID / UG_CUJ_SP_CLIENT_SECRET identity needs workspace access, read access to config/model discovery, and use access to those services. Only a short-lived bearer reaches agent processes. Each case checks that the workspace remains unmanaged. The preservation cases seed distinct Sonnet and other-family defaults on a clean disposable runner, assert Sonnet inference and unchanged defaults, then remove that local input.

Regression verification: before and after #1037

Ran the same post-fix component test files (tests/test_cli.py, tests/test_agent_claude.py, and tests/test_agent_codex.py) against isolated source snapshots of the merged #1037 fix and its immediate parent. Confirmed imports came from the intended snapshot in each run.

Source revision	Identical updated component suite
Before fix: abf85db12d39c6c78a30b503cc0c7632d26245c6	957 passed, 6 failed
After fix (#1037): de4b119d9e8678131b0e6bd15addeb136164d72f	963 passed

All four test_unmanaged_claude_model_reaches_native_launcher regressions (Claude/GPT IDs × separate/equals spellings) fail before the fix specifically because the native command omits --model MODEL; all four pass after it. The pre-fix revision's original component suite passes 959 tests, demonstrating that the previous assertions missed this boundary.

The older live explicit-model test only placed --model after --, bypassing UG's model-selection path. Coverage now includes the normal UG-owned option before the separator as well as supplemental native forwarding. The before/after comparison is component evidence, not a live CUJ or real-inference comparison.

Current validation

• After rebasing onto [AIGTWY-4972] Consolidate CUJ helpers, fix flakes, parallelize CUJs #1040 and migrating helpers: 1,192 component/helper/contract tests passed.
• All eight CUJ7 cases collect; the CI discovery contract recognizes the file and its unique shard name.
• Repository-wide Ruff checks and formatting, source type checks, and git diff --check: passed.
• Live inference was not run locally: this host has /etc/claude-code/managed-settings.json, which can override isolated agent settings and model selection. The suite requires a clean disposable runner; CI must validate live inference and SP permissions.

[github-actions]

UG review

The visible changes cover unmanaged model discovery, explicit model forwarding, scoped inference evidence, and cleanup of seeded OS-managed settings. Review is limited to the shown changes because the supplied diff is truncated.

No actionable findings.

Some patches were unavailable or truncated to fit the review context. Treat this as a partial review.

Automated advisory review of 1fbc5d7955fb using Lilly's UG review rubric. It does not approve or block this PR.

[david-siqi-liu]

Reviewed against main's tests/e2e_cuj/AGENTS.md and the CUJ 7 plan in the UG Configure E2E doc. Blocking items only:

P0

1. E2E CUJs is red: all four CUJ 7 cases error at setup with Existing machine-wide agent settings; use a clean disposable runner (https://github.com/databricks/unity-gateway/actions/runs/37523961500/job/112476241517). That run predates #993, which added the terminal ug revert to the shared cuj teardown, so the leftover files likely came from CUJ 4 earlier in the job. A rebase onto current main (it also conflicts in tests/README.md) and a green E2E CUJs run would confirm. Separately, live_session is per test and only asserts MANAGED_PATHS are absent at setup; test_case_07 launches ug claude in a terminal with no revert afterwards, so if that launch writes machine-wide files, the next case fails the same way.
2. Coverage: the plan's "preexisting claude family defaults in managed settings are preserved when running ug claude and do NOT pick up ug's default" case isn't in the diff (no ANTHROPIC_DEFAULT_* setup or assertion anywhere).