refactor: extract clawdstrike-hushd-config crate, dedupe agent/hushd config types (#339)

Phase 1 P1-D of the desktop-agent refactor swarm. The desktop agent writes a
runtime YAML config that hushd must read. Both sides previously defined their
own private DTOs with the same field names. Drift between writer and reader
would silently break daemon startup at runtime, so this PR centralises the
on-disk format in a new shared crate, `clawdstrike-hushd-config`.

Crate layout:
- `runtime::RuntimeConfig`           - top-level on-disk shape
- `siem::SiemConfig + ExportersConfig + per-provider configs`
- `spine::SpineConfig`               - replaces hushd's local SpineConfig
- `webhook::GenericWebhookConfig + WebhookAuthConfig`

Writer (`apps/agent/src-tauri/src/daemon.rs`): dropped 14 local DTOs
(lines 81-202 pre-extraction) and replaced them with re-exports from the new
crate. The construction sites in `build_runtime_siem_config`,
`build_runtime_spine_config`, and `build_generic_webhook_exporter` now build
the shared types directly.

Reader (`crates/services/hushd/src/config.rs`): re-exports
`clawdstrike_hushd_config::SpineConfig` and drops the local copy. Added a
contract test that round-trips the writer's full sample YAML into hushd's
`Config` so future drift is caught at compile or test time. Added a legacy-YAML
test that proves existing on-disk configs with `keypair_path: String` still
deserialize into the shared `Option<PathBuf>` field.

Co-authored-by: bb-connor <bb-connor@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bb-connor

Cargo.lock

@@ -34,6 +34,7 @@ members = [
     "crates/libs/hunt-correlate",
     "crates/libs/clawdstrike-ocsf",
     "crates/libs/clawdstrike-policy-event",
+    "crates/libs/clawdstrike-hushd-config",
     "crates/libs/clawdstrike-logos",
     "crates/libs/logos-ffi",
     "crates/libs/hushspec",
@@ -180,6 +181,7 @@ logos-ffi = { path = "crates/libs/logos-ffi", version = "0.2.7" }
 logos-z3 = { path = "crates/libs/logos-z3", version = "0.2.7" }
 clawdstrike-ocsf = { path = "crates/libs/clawdstrike-ocsf", version = "0.2.7" }
 clawdstrike-policy-event = { path = "crates/libs/clawdstrike-policy-event", version = "0.2.7", default-features = false }
+clawdstrike-hushd-config = { path = "crates/libs/clawdstrike-hushd-config", version = "0.2.7" }
 nono = { path = "infra/vendor/nono", version = "0.11.0", default-features = false }
 
 [profile.release]

Cargo.toml

@@ -60,6 +60,7 @@ which = "6"
 # Shared crypto/data primitives
 hush-core = { path = "../../../crates/libs/hush-core" }
 clawdstrike-policy-event = { path = "../../../crates/libs/clawdstrike-policy-event", default-features = false, features = ["simulate"] }
+clawdstrike-hushd-config = { path = "../../../crates/libs/clawdstrike-hushd-config" }
 base64 = "0.22"
 
 # NATS / Spine (adaptive SDR)