feat: multi-project architecture — config, sessions, CLI

[harsh-batheja]

What this PR does

Implements multi-project support so a single ao installation can manage multiple repos simultaneously. Also hardens the config loading pipeline, running state, and session ID management.

Added

Core infrastructure (packages/core)

• global-config.ts — global registry at ~/.agent-orchestrator/config.yaml storing project identity; per-project behavior in local agent-orchestrator.yaml files (hybrid mode)
• migration.ts — buildEffectiveConfig merges global registry + local configs into a standard OrchestratorConfig
• multi-project-start.ts — resolveMultiProjectStart + registerNewProject + validateAndCommitRegistration: pure registration logic with validate-first, write-after semantics and concurrent registration detection
• OrchestratorSessionStrategySchema in global-config.ts — shared Zod schema (used by both LocalProjectConfigSchema and ProjectConfigSchema) to eliminate config drift; normalizes legacy aliases (kill-previous → delete, ignore-new → ignore)
• DEFAULT_NOTIFICATION_ROUTING moved from config.ts → global-config.ts to break circular dependency with migration.ts
• ConfigMode type on ProjectConfig (hybrid | global-only); globalConfigPath and projectOrder on OrchestratorConfig

CLI (packages/cli)

• ao project list — show all registered projects
• ao project add <path> — register a directory; auto-derives ID, handles collisions; accepts --id and --name overrides
• ao project remove <id> — unregister a project with confirmation
• ao spawn -p/--project <id> — remote mode, works from any directory
• In-process lifecycle manager — replaces detached ao lifecycle-worker subprocess; now runs inside ao start
• addProjectToRunning / killRunningInstance in running-state.ts — track secondary PIDs in running.json; killRunningInstance signals all PIDs on stop
• forcedSuffix support in spawnOrchestrator / reserveNextOrchestratorIdentity — CLI-computed suffix is honoured instead of auto-incremented

Changed

• ao start auto-registers new hybrid projects on first run; multi-project "new orchestrator" path sets attachToRunning=true + orchestratorSessionStrategy: 'new' + orchestratorSuffix
• Config loading pipeline (expandPaths, applyProjectDefaults, applyDefaultReactions, collectExternalPluginConfigs) — all return new objects; no in-place mutation
• loadConfig / loadConfigWithPath reject empty project registries before returning; ZodError fallback consistent between both paths
• validateAndCommitRegistration runs applyGlobalConfigPipeline (validates session prefix uniqueness) before saveGlobalConfig — write-after-validate pattern
• Legacy ignore-new → ignore alias fixed (was erroneously mapped to new)
• getEffectiveConfigPath synthesizes per-project virtual path in multi-project mode to prevent storage dir collision when projects share a basename

Removed

• ao remove-project <id> — replaced by ao project remove <id>
• ao lifecycle-worker detached subprocess — in-process replacement; stub kept for backward compatibility (exits 1 with deprecation message)

Test plan

• ao start in a new hybrid project dir registers it automatically
• ao project list shows registered projects
• ao project add <path> registers; --id/--name overrides work; collision appends suffix
• ao project remove <id> unregisters with confirmation
• ao start with two projects that share a directory basename creates distinct storage dirs
• ao stop terminates both the primary and secondary PIDs
• ao lifecycle-worker prints deprecation message and exits 1

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9400d9c. Configure here.}