fix(antigravity): launch the managed agy with a CSRF token

[prakersh]

Fixes #140.

agy's language server rejects Connect-RPC calls without a CSRF token. On Windows it enforces one even when none was given at launch, so the managed agy session never became ready and every Antigravity CLI poll failed with "quota service did not become ready" after 90s.

Change

• Each managed agy launch gets a fresh random --csrf_token (16 bytes, hex). A relaunch gets a new one.
• The token is sent as X-Codeium-Csrf-Token on the readiness probe, the quota summary and user status calls, and the health check.
• The token is never logged.

Verification

• macOS, real agy: launched with a token, it answers 401 "missing CSRF token" without the header and 200 with it, so one code path covers all platforms.
• macOS, real runner end to end (launch, port discovery, probe, fetch, warm fetch): ready in 5s, 4 models, and the process is reaped on Stop.
• Windows behaviour is as reported and validated in [Bug] Windows: Antigravity CLI collector fails with "quota service did not become ready" due to missing CSRF token #140.
• New unit tests for the header and launch args. Full race suite passes.

[codecov]

Codecov Report

❌ Patch coverage is 40.90909% with 13 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/api/antigravity_cli.go	40.90%	12 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!