feat(mcpd): AgentService virtual methods + GC cascade (v3 Stage 2)

State machine for kind=virtual Agent rows. Mirrors what
VirtualLlmService did for Llms in v1, then wires both lifecycles
together so disconnect/heartbeat/GC cascade through both at once.

AgentRepository:
- create/update accept the new lifecycle fields (kind, providerSessionId,
  status, lastHeartbeatAt, inactiveSince).
- Adds findBySessionId, findByLlmId, findStaleVirtuals, findExpiredInactives.

AgentService — new virtual-agent methods:
- registerVirtualAgents(sessionId, inputs, ownerId) — sticky upsert.
  New names insert as kind=virtual/status=active. Existing virtuals
  owned by the same session reactivate; existing inactive virtuals
  from a foreign session can be adopted (sticky reconnect). Refuses
  to overwrite a public agent or a foreign session's still-active
  virtual (HTTP 409). Pinned LLM is resolved via LlmService — caller
  posts Llms first.
- heartbeatVirtualAgents(sessionId) — bumps owned agents on a session
  heartbeat; revives inactive rows.
- markVirtualAgentsInactiveBySession(sessionId) — disconnect cascade.
- deleteVirtualAgentsForLlm(llmId) — defensive cascade for the GC's
  Llm-delete step (Agent.llmId is Restrict).
- gcSweepVirtualAgents() — same shape as VirtualLlmService.gcSweep
  (90s heartbeat-stale → inactive, 4h inactive → delete).

VirtualLlmService:
- Optional AgentService dependency. heartbeat() now also bumps owned
  agents; unbindSession() flips them inactive. gcSweep() runs the
  agent sweep FIRST (so any agent that would block an Llm delete via
  Restrict is already gone), and adds a defensive
  deleteVirtualAgentsForLlm step right before each Llm delete in case
  an agent's heartbeat lagged its Llm's just enough to escape this
  round's 4h cutoff.

main.ts:
- VirtualLlmService construction moves below AgentService so it can
  receive the cascade dependency.

Tests: 13 new in virtual-agent-service.test.ts cover all the register
variants (insert, sticky reconnect, adopt-inactive-foreign, refuse
public-overwrite, refuse foreign-session-active), heartbeat-revive,
disconnect-cascade, deleteVirtualAgentsForLlm scope, GC sweep flip
+ delete + idempotence, and three VirtualLlmService cascade scenarios
(unbindSession, gcSweep deleting agent before Llm, defensive cascade
when agent's heartbeat lagged).

mcpd suite: 854/854 (was 841 + 13 new). Workspace unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/Dockerfile.mcpd

@@ -1,3 +1,9 @@
+# syntax=docker/dockerfile:1.6
+# `# syntax=...` enables BuildKit's --mount feature on the builder so we can
+# share the pnpm content-addressed store across image builds. Without it the
+# next two RUN steps fall back to plain mode and the cache mount is ignored
+# (build still works, just slower).
+
 # Stage 1: Build TypeScript
 FROM node:20-alpine AS builder
 
@@ -12,8 +18,12 @@ COPY src/db/package.json src/db/tsconfig.json src/db/
 COPY src/shared/package.json src/shared/tsconfig.json src/shared/
 COPY src/web/package.json src/web/tsconfig.json src/web/
 
-# Install all dependencies
-RUN pnpm install --frozen-lockfile
+# Install all dependencies. The cache mount keeps pnpm's CAS store warm
+# across builds: only newly-changed packages get downloaded; everything
+# else hardlinks from the cache. Drops install from ~60s to <5s on a
+# warm cache. `--frozen-lockfile` still guarantees lockfile fidelity.
+RUN --mount=type=cache,id=pnpm-store-mcpd-builder,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
 
 # Copy source code
 COPY src/mcpd/src/ src/mcpd/src/
@@ -42,8 +52,11 @@ COPY src/mcpd/package.json src/mcpd/
 COPY src/db/package.json src/db/
 COPY src/shared/package.json src/shared/
 
-# Install all deps (prisma CLI needed at runtime for db push)
-RUN pnpm install --frozen-lockfile
+# Install all deps (prisma CLI needed at runtime for db push). Same
+# cache-mount trick as the builder stage; separate cache id so the two
+# stages don't compete for the same lock.
+RUN --mount=type=cache,id=pnpm-store-mcpd-runtime,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
 
 # Copy prisma schema and generate client
 COPY src/db/prisma/ src/db/prisma/

vitest.config.ts

@@ -1,8 +1,21 @@
 import { defineConfig } from 'vitest/config';
+import { availableParallelism } from 'node:os';
+
+// Default vitest's pool to ~half the CPU threads we have. The previous
+// implicit default left this 64-thread workstation at ~10% utilization
+// during `pnpm test:run`. Half is a soft cap that stays kind to laptops
+// (8-thread → 4 workers) while letting beefy hosts push closer to the
+// box's actual capacity. Override at run time with VITEST_MAX_THREADS.
+const cores = availableParallelism();
+const maxThreads = Number(process.env['VITEST_MAX_THREADS'] ?? Math.max(2, Math.floor(cores / 2)));
 
 export default defineConfig({
   test: {
     globals: true,
+    pool: 'threads',
+    poolOptions: {
+      threads: { maxThreads, minThreads: 1 },
+    },
     coverage: {
       provider: 'v8',
       reporter: ['text', 'json', 'html'],