Add `openagents trace` namespace to discover and upload ATIF traces #14

Outcome

Add an openagents trace namespace to the Effect CLI that discovers local coding-agent session exports, redacts them, wraps them as ATIF traces, and uploads them to openagents.com with a private default.

Current state

The forge stores the authoritative turns, tool steps, and receipts behind OpenAgents. A trace is the public-safe, consent-gated ATIF projection of that work. Today there is no CLI path for exporting sessions from other agents (Claude, Codex, Grok, Entire, and others) into forge traces.

Work

• openagents trace discover: scan known local paths and list candidate session or conversation exports with source, local ID, agent, and timestamp.
• openagents trace upload <id>: convert the selected export to ATIF, apply a redaction policy, and upload it to the forge trace ingest endpoint.
• --redaction option on upload: choose minimal, standard (default), or dark. Standard redaction removes secrets, tokens, environment variables, and absolute local paths.
• Default every upload to owner_only visibility. Require explicit --unlisted or --public flags to relax it.
• Add configuration for local source directories, e.g. OPENAGENTS_TRACE_PATHS or the openagents config file.
• Treat the uploaded trace as a non-authoritative projection. The CLI must not rewrite or delete source session records.

Acceptance criteria

• openagents trace discover finds Claude, Codex, and Grok session exports without manual setup.
• openagents trace upload returns an openagents.com trace URL and reports the redaction level and removed categories.
• Uploaded traces default to owner_only.
• The generated ATIF document is valid against the ATIF-v1.7 schema.