tenant.openagents/omega

Let a device in another process read what this host publishes (omega#97)

Let a device in another process read what this host publishes (omega#97) The host half's live proof addresses a freshly generated device key, so the records it writes to the deployed relay can be opened by nobody: the secret dies with the test. That is fine for proving the host publishes and wrong for proving a phone reads. `OMEGA_LIVE_DEVICE_PUBKEY` lets the reader nominate itself. It supplies only its public key — the secret never leaves the reading process, so the gift wraps still have exactly one possible reader, and it is not this one. `OMEGA_LIVE_PAIRING_OUT` writes the four pairing records the grant folds out of. A device needs them and cannot obtain them: `record_emitted_pairing` files a record with the controller, it does not publish one. The handoff carries no secret and no adjunct body — the adjuncts stay on the relay, which is the whole point. A device handed the reading directly would prove nothing about delivery. Both are read inside the existing `#[ignore]`d live test and default to the previous behaviour when unset. `live_paired_controller_with_records` is the same builder as before, additionally returning the records it built. Used by openagents `apps/openagents-mobile/tests/issue31-live-host-device.test.ts`, which reads a real packaged `omega-effectd` reading off deployed `wss://relay.openagents.com` and renders it into the mobile Workroom rows. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>