Harden transports and state files

- Executors and relay helpers get an environment without any configured
  Plane token / webhook secret (design 8: executors hold no Plane credentials).
- Windows runner: Set-Location -LiteralPath, and a failed cd writes exit=97
  instead of running the agent in the wrong directory.
- schtasks launch: escape apostrophes and pass the script path as \"...\" so
  paths with spaces survive PowerShell 5.1 native quoting.
- State and heartbeat files are written temp + fsync + rename.
- Tests for the above plus codex run/resume command shapes and unique run dirs.

agentd/store.py

@@ -31,11 +31,18 @@ class Store:
         data.setdefault("paused_groups", {})
         return data
 
-    def save(self, data):
+    def _atomic_write(self, path, obj):
+        """Write temp + fsync + rename, so a reader (or a crash) never sees half a file."""
         self.dir.mkdir(parents=True, exist_ok=True)
-        tmp = self.path.with_suffix(".tmp")
-        tmp.write_text(json.dumps(data, ensure_ascii=False, indent=1), encoding="utf-8")
-        os.replace(tmp, self.path)
+        tmp = path.with_suffix(".tmp")
+        with open(tmp, "w", encoding="utf-8") as fh:
+            fh.write(json.dumps(obj, ensure_ascii=False, indent=1))
+            fh.flush()
+            os.fsync(fh.fileno())
+        os.replace(tmp, path)
+
+    def save(self, data):
+        self._atomic_write(self.path, data)
 
     @contextlib.contextmanager
     def lock(self):
@@ -48,9 +55,8 @@ class Store:
             yield
 
     def heartbeat(self, info):
-        self.dir.mkdir(parents=True, exist_ok=True)
         info = dict(info, ts=time.time(), at=time.strftime("%Y-%m-%dT%H:%M:%S"))
-        (self.dir / "heartbeat.json").write_text(json.dumps(info, ensure_ascii=False, indent=1), encoding="utf-8")
+        self._atomic_write(self.dir / "heartbeat.json", info)
 
     def log(self, msg):
         self.dir.mkdir(parents=True, exist_ok=True)