Support explicit Claude settings in profiles/backend and define mission apply order

[Th0rgal]

Problem

When running missions with the Claude Code backend, mission bootstrap writes a fresh workspace .claude/settings.json and runs with per-mission HOME + CLAUDE_CONFIG(_DIR). This can bypass/override user Claude host settings (including commit attribution behavior such as includeCoAuthoredBy).

Today, library config profiles expose Claude settings via a typed ClaudeCodeConfig, but only a narrow subset is represented and applied.

Why this matters

Users expect Claude behavior (especially attribution/co-author defaults) to be controlled from profile settings in sandboxed.sh, not by implicit mission-generated defaults.

Current implementation references

• Per-mission Claude config env and isolated home:
  • src/api/mission_runner.rs (sets HOME, XDG_*, CLAUDE_CONFIG_DIR, CLAUDE_CONFIG)
• Mission workspace writes fresh Claude settings:
  • src/workspace.rs write_claudecode_config(...) writes .claude/settings.json / settings.local.json
• Profile Claude config is strongly typed and limited fields are persisted:
  • src/library/types.rs (ClaudeCodeConfig)
  • src/library/mod.rs (get/save_claudecode_config_for_profile)
• Dashboard sanitizes Claude settings to a narrow schema for default profile save/sync:
  • dashboard/src/app/config/settings/page.tsx (coerceClaudeCodeConfig)

Requested change

Add explicit Claude settings support in backend config/profile and define clear apply semantics.

Minimum scope

1. Add explicit support for Claude attribution/co-author control at profile/backend level

• Include includeCoAuthoredBy (or equivalent canonical internal field mapped to Claude settings).
• Keep backward compatibility with existing ClaudeCodeConfig.attribution.

2. Define and implement merge/apply order for mission startup

• Proposed precedence (highest -> lowest):
  1. Mission request explicit overrides
  2. Workspace-selected config profile (configs/<profile>/.claudecode/settings.json)
  3. Library default profile
  4. Generated runtime defaults (MCP/permissions/runtime-only fields)
• Runtime-generated fields should be merged in a way that does not discard user-configured Claude keys.

3. Preserve Claude-native keys in dashboard/profile editing

• Avoid narrowing Claude settings to only default_model/default_agent/hidden_agents when saving profile/default settings.

4. Document behavior

• Add docs for:
  • which Claude settings are supported explicitly,
  • where they should be configured,
  • when they are applied,
  • and exact precedence.

Acceptance criteria

• Setting co-author attribution behavior in a config profile affects new Claude missions consistently.
• User-provided Claude keys are not silently dropped during save/sync.
• Mission bootstrap keeps required runtime fields (MCP/permissions/hooks) while preserving profile/user Claude settings.
• Behavior is documented in docs-site and/or settings UI help text.