[forhappy]

Add a runnable Python agent using PydanticAI in Cellar's embedded CPython host. A named cell accepts a task, checkpoints model messages and deferred tool calls, applies its save_note tool and receipt atomically, then resumes from durable alarms until it saves the answer. Duplicate submissions replay the acceptance receipt; conflicting input is refused. Cancellation fences late model results.

The default uses PydanticAI's deterministic FunctionModel and needs no credentials. Explicit configuration enables OpenAI with an invocation-owned client. Attempts are charged durably before model I/O; retries, steps, history and tool output are bounded. Provider exceptions are sanitized. Interrupted model calls may repeat and incur charges; the example makes no exactly-once provider-call or arbitrary external-side-effect claim.

Include a walkthrough, locked/hash-verified dependencies, a source/runtime inventory descriptor, a compiled host, a verified package command and standard/free-threaded CI jobs. Extract the existing FastAPI package builder into a shared helper while retaining its CLI. Also carry forward the previously prepared Raft recovery failure contexts, without changing assertions, deadlines or runtime behavior.

Validation:

• Eight agent tests pass on standard and free-threaded CPython 3.14.5. Cases include atomic write failure, duplicate alarms, cancellation during model I/O, persisted interrupted-attempt accounting, bounded/sanitized provider failure, invalid tool batches, and the real OpenAI SDK/PydanticAI provider through a local HTTP mock. Provider clients close; the free-threaded provider path keeps the GIL disabled.
• Real HTTP smoke tests pass on both ABIs. A new host process resumes a saved deferred tool intent and pending alarm, applies one notebook effect, completes its answer, replays receipts and handles four independent agents. Both shutdown reports join cleanly.
• The free-threaded package builder captures, bundles and verifies 7,770 provisioned files. The inventory-bound prepared project passes the real host smoke test. This checks the packaged configuration; a separate offline installation/recovery drill was not run for this new example.
• Strict Clippy for the new embedded host, Rust formatting, module layout, native dependency guards, documentation links and dependency/descriptor consistency checks pass.

No paid live model calls or multi-node agent failover qualification were performed. The new Linux CI matrix must validate this PR head. Earlier membership/snapshot suites passed for the carried-forward diagnostic-only commit; those diagnostics do not claim to fix the older intermittent qualification failures.