feat(devenv): implement human-owned activation contract #478

Intent

Implement the human-owned devenv/direnv activation contract from ADR-0030 without auto-approving workspace trust decisions.

Parent: #473
ADR: #474

Scope

• Ensure acq exec, acq shell, and agent run paths land in the primary repository with a login shell.
• Detect when a workspace appears to need devenv/direnv activation and surface the command for the human.
• Do not run direnv allow, devenv allow, devenv shell, or equivalent activation non-interactively by default.
• Add an explicit ACQ_ opt-in for non-interactive activation if needed, scoped to the user's environment.
• Keep trust path/worktree-scoped rather than globalized by acq.

Deferred Decisions

• The exact opt-in variable name can be decided at implementation time.
• Whether detection relies on direnv state, devenv JSON introspection, or both can be decided after probing current tool behavior.

Acceptance Criteria

• Default behavior surfaces activation but does not approve it.
• Opt-in behavior is explicit and auditable.
• Existing non-devenv projects are unaffected.
• Tests cover default non-activation, surfaced guidance, and opt-in behavior.

Orchestration Notes

Implementation should be done by an authoring sub-agent and reviewed by an independent adversarial review sub-agent. Review findings must be addressed before the increment is accepted.