fix(presets): admit reviewed ACP endpoint connections

[osolmaz]

Summary

Harbor’s ACP agent rejects the model_api option, so reviewed endpoint presets could not start an ACP run.
This change keeps the approved endpoint URL and key delivery, while leaving ACP options in the form Harbor accepts.
A source-pinned ACP agent can now use a reviewed endpoint connection without changing other agent presets.

What Changed

ACP gets its client configuration from its pinned source. The connection still requires an explicitly named API style and one approved grant.

• Skip model_api in the ACP agent’s native kwargs; keep it for agents that support the option.
• At submit and restart, require exactly one matching ACP grant for the native import path, version, model, operator, worker image, and key reference. Refuse ambiguous grants and injected model_api values.
• Document the difference and add focused denial tests.

I checked pinned Harbor revision fcf27e5502e30436b067ef2d655368e86cc42cf9: src/harbor/agents/installed/acp.py (AcpOptions, AcpAgent), src/harbor/agents/options.py (InstalledAgentOptions) and src/harbor/models/agent/acp_source.py (AcpAgentSource). Harbor already owns source installation and ACP execution. This change adds no runner, mirrored field, or result format.

Testing

The targeted ACP test and the full suite pass when the test locale matches its USD-format expectation. A live ACP endpoint run remains to be checked before this draft is ready.

• LC_ALL=en_US.utf8 npm test (1,718 passed)
• npm run format:check, npm run lint, npm run typecheck, npm run build, npm run check:generated
• npm audit --audit-level=low (zero vulnerabilities)
• npm run test:e2e (77 passed)
• uv run python scripts/check_public_privacy.py .

Risks

ACP does not store an API-style argument in its native JobConfig. The reviewed source must configure the intended client; an ambiguous grant is refused on restart. The hosted canary has not run yet. An unset locale on this machine uses en-SG and fails three unchanged currency-string assertions because it prints US$ instead of $.

Follow-ups

Run the hosted ACP canary against a reviewed source and verify its results and cleanup before marking this pull request ready. No related issue was opened.