chore(harbor): pin the default fork to f6b86c4 for the tbh agent (#986)

* chore(harbor): pin the default fork to 2a43740

Picks up Harbor PR #14 (tbh build-name selection). The range from the
previous pin touches only the tbh agent and its tests, so nothing else
in the worker image changes.

Note this pin alone does not make tbh runnable: Harbor PR #15 carries
the fbcode loader fix and the real 'muse exec' invocation, and is not
on harbor main yet. This pin has to move again once it merges.

Co-authored-by: rishi <rishi@abundant.ai>

* chore(harbor): move the pin to f6b86c4 for the tbh CLI integration

Harbor PR #15 merged, so the pin now carries the fbcode loader fix and
the real 'muse exec' invocation. Verified against this pin: the agent
resolves, defaults to META_API_KEY, installs the loader symlink, runs
the exec subcommand with web tools off, routes to the meta queue key
with api.ai.meta.com allowlisted, and answers the restricted-network
capability hook.

Co-authored-by: rishi <rishi@abundant.ai>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: RishiDesai

backend/uv.lock

@@ -151,9 +151,9 @@ def nop_oracle_kind(agent: str | None) -> str | None:
 # trials run a heavier GKE-enabled Harbor on a dedicated blessed-variant image
 # (see HARBOR_VARIANTS in oddish.core.harbor_source), never this default.
 HARBOR_DEFAULT_SOURCE = "https://github.com/abundant-ai/harbor"
-# abundant-ai/harbor main, as resolved into both uv.lock files. Harbor PRs #12
-# and #13 (the tbh agent) merged as this commit.
-HARBOR_DEFAULT_SHA = "12e1e055d5b5865a0c366e6b5acb62f548dc8775"
+# abundant-ai/harbor main, as resolved into both uv.lock files. Harbor PR #15
+# (the tbh agent's real CLI integration) merged as this commit.
+HARBOR_DEFAULT_SHA = "f6b86c4edb57d2993510aae0d10832790ee6ba0a"
 
 _HARBOR_URL_PREFIXES = ("git+", "http://", "https://", "ssh://")