fix(acp): expose terminal auth before credential setup

[yxlyx]

What changed

• Let a clean graff acp process answer initialize before provider credential resolution and advertise the existing graff-login Terminal Auth method.
• Keep the credential-free ACP process protocol-valid, returning ACP AuthRequired for session/model operations until the client runs graff login and restarts it.
• Reuse the full engine's initialize responder and bound per-record parsing memory; oversized records are discarded through their newline without killing the process.
• Restore an early fullscreen TUI claim before showing the existing missing-credential diagnostic.
• Add registry-shaped subprocess and real-PTY regressions.

Why

Problem / failure mode

The ACP Registry installs and starts agents in an isolated HOME, then sends initialize to discover authentication. Graff advertised Terminal Auth only after resolveKeys; without a credential it exited first, so fresh registry installs could never discover or launch graff login. Registry PR agentclientprotocol/registry#558 therefore cannot pass its auth matrix while pinned to v0.0.280 (or v0.0.282).

Reason for this approach

The pre-auth loop has no fake provider and does not duplicate the initialize payload. It shares acp_engine.respondInitialize, serves only protocol/auth discovery, and returns the standard ACP auth-required error for operations needing an Agent. Once login succeeds, a restarted process follows the unchanged credentialed ACP runtime.

Constraints and trade-offs

• Accepted NDJSON records are capped at 65,535 bytes. Larger records are boundedly discarded and the next record is still processed.
• Parsed request memory is reset after each response flush, retaining only bounded scratch capacity.
• The canonical registry listing remains the existing external PR feat(adapters): long-running channel workers that wake sessions #558. This PR must ship in a new release, then feat(adapters): long-running channel workers that wake sessions #558 must update its six URLs/checksums before merging.
• TUI, line REPL, one-shot, resume, and compaction runtime behavior remain downstream of the existing credentialed startup path.

Rejected alternatives

• A dummy API key would make initialization pass while producing a broken session on the first model request.
• Printing one initialize response and exiting would satisfy a narrow probe but violate ACP lifecycle semantics.
• Duplicating auth metadata in a second responder would let the pre-auth and full runtimes drift.

Verification

• Current ACP Registry auth checker: graff-login(terminal) passed
• scripts/eval-tier1.sh: green
• main suite: 1867 tests
• TUI suite: 465/465
• PTY/tuiguard: 17/17, including clean missing-credential tui and TTY repl
• 2,048 near-limit pre-auth records reuse bounded scratch memory

Addresses #613. The issue closes after a release containing this change is pinned and merged in agentclientprotocol/registry#558.