feat: dual execution model (SSH CLI + HTTP pull)

- ExecutionMode enum: SshCli (orchestrator dispatches) | HttpPull (agent pulls)
- SSH CLI executor: spawn remote agents via ssh + CLI template
- Local subprocess as SSH special case (localhost)
- HostConfig with capability matching and load-based selection
- Dispatch loop: scan created tasks → select host → execute → update
- CliAdapterConfig: CLI templates for Codex and Claude Code
- Structured prompt construction (Issue → goal/constraints/validation)
- Output parsers: Codex JSON, Claude Code JSON, raw fallback
- TaskStatus::ReviewPending + review_count loop limit
- Forgejo webhook: pull_request (opened→review_pending, merged→completed)
- Forgejo webhook: push events (task/* branch → last_activity_at)
- HTTP API: dequeue only returns http_pull tasks
- HTTP API: status update only for http_pull mode
- Token auth config for http_pull agents
- Adapter module rewritten: AgentAdapter trait removed → config-driven CLI templates
- New fields: execution_mode, assigned_host, branch_name, pr_title, last_activity_at, review_count
- 30/30 tests pass

openspec/changes/dual-execution-model/specs/agent-adapter/spec.md

@@ -0,0 +1,41 @@
+## MODIFIED Requirements
+
+### Requirement: Agent adapter as CLI template
+每个 Agent 类型 SHALL 定义为 CLI 命令模板 + 输出解析器，而非代码 trait。Orchestrator 根据模板构造命令、通过 SSH 执行、解析输出。
+
+#### Scenario: Codex CLI adapter definition
+- **WHEN** Agent 类型为 `codex-cli`
+- **THEN** adapter 定义 SHALL 包含：
+  - `cli_template`: `codex exec --json '{prompt}'`
+  - `work_dir`: `{repo_path}`
+  - `output_format`: `json`
+  - `timeout`: 3600
+  - `output_parser`: codex_json_parser
+
+#### Scenario: Claude Code adapter definition
+- **WHEN** Agent 类型为 `claude-code`
+- **THEN** adapter 定义 SHALL 包含：
+  - `cli_template`: `claude -p '{prompt}' --output-format json --dangerously-skip-permissions`
+  - `work_dir`: `{repo_path}`
+  - `output_format`: `json`
+  - `timeout`: 3600
+  - `output_parser`: claude_json_parser
+
+#### Scenario: Custom adapter with custom template
+- **WHEN** 用户定义新的 Agent 类型
+- **THEN** SHALL 能通过配置文件指定 CLI 模板和输出格式
+
+#### Scenario: http_pull mode — no adapter needed
+- **WHEN** Agent 使用 http_pull 模式（如 OpenClaw/Jeeves）
+- **THEN** 不需要 CLI adapter 定义，Agent 通过 HTTP API 自行交互
+
+### Requirement: Adapter configuration
+Agent 实例配置 SHALL 关联到具体主机，包含连接信息和执行参数。
+
+#### Scenario: Remote Codex on host-worker-02
+- **WHEN** 配置 host-worker-02 上的 Codex
+- **THEN** 配置 SHALL 包含：`{host: "host-worker-02", agent_type: "codex-cli", max_concurrency: 2, model: "gpt-5.5", capabilities: ["code:rust"]}`
+
+#### Scenario: Local Codex on same machine
+- **WHEN** Agent 运行在 Orchestrator 同一台机器
+- **THEN** SSH 可替换为本地 subprocess，无需 SSH 开销