Add IBM Bob as an example agent harness

[matoushavlena]

Problem Statement

Humr currently ships three example agent images (Claude Code, Google Workspace, Pi). Users evaluating Humr as a harness-agnostic platform can't see IBM Bob — IBM's AI coding agent for enterprise/mainframe modernization — running on it. This limits Humr's story as "bring any harness" and leaves a gap for IBM-aligned users (regulated industries, mainframe, Granite models).

Solution

Add IBM Bob as a fourth example agent under packages/agents/bob/, following the same pattern as pi-agent and google-workspace:

• A Dockerfile installing BobShell on top of humr-base
• A workspace/ seed directory with any required Bob config
• A Helm template deploy/helm/humr/templates/bob-template.yaml (off by default, like the other non-Claude examples)
• Wiring into deploy/tasks.toml image build/save/load steps

The goal is exploratory, not production — prove BobShell can be invoked by agent-runtime via ACP and that a session opens in the Humr UI.

User Stories

• As a Humr evaluator interested in IBM tooling, I want to spin up an IBM Bob agent from the Humr UI so I can see Bob driven through the Humr chat interface.
• As a Humr contributor, I want a working bob example agent so I have a reference when adding new non-ACP-native harnesses.
• As a platform maintainer, I want Bob disabled by default so users without IBM credentials aren't blocked.

Implementation Decisions

• Scope is exploratory. Expect this PR to land with known limitations documented (e.g., "requires BobShell x.y.z, auth via env var BOB_API_KEY for now"). OneCLI provider integration is out of scope for this PRD.
• Investigate-before-build spikes (each resolvable in ≤½ day):
  1. How is BobShell distributed? (npm? tarball? IBM-hosted installer?) — determines the RUN line in the Dockerfile.
  2. Does BobShell speak ACP? If not, does a community bridge exist, or do we need a thin adapter? If unclear/infeasible, fall back to running BobShell under the ACP bridge pattern used by pi-acp.
  3. What's the minimum auth surface? Probably a single API key / IBMid token passed as env — good enough for an example.
• Default LLM: whatever BobShell uses out of the box. Claude-backed is fine; Granite is a nice-to-have.
• Name: bob (directory packages/agents/bob/, Helm values key bobTemplate, ConfigMap name bob).
• Workspace seed: minimal — only what BobShell needs to start in /home/agent/work. Skills/prompts can be added later.
• Off by default in values.yaml (bobTemplate.enabled: false), matching piAgentTemplate / googleWorkspaceTemplate.
• Out of scope: OneCLI credential provider for IBM, Granite-specific tuning, mainframe integrations, production hardening.

References

• IBM Bob product page
• IBM Project Bob announcement
• The Power of IBM Bob Shell — Niklas Heidloff