feat: orchestrator enhancements, agent model refactor, dashboard UX improvements

[partarstu]

Summary

This PR delivers a broad set of enhancements across the orchestrator, agents, dashboard UI, deployment pipeline, and test coverage. It also introduces three new developer skills and fixes several bugs and test issues.

Changes

Features

• Dashboard: Paginated log viewer — LogViewer now supports "Load More" via infinite query; backend /api/dashboard/logs adds offset parameter
• Dashboard: Manual agent discovery — New POST /api/dashboard/discovery endpoint and "Discover Agents" button in the AgentGrid UI
• Agent model settings centralized — CustomLlmWrapper.create_agent() factory replaces per-agent Agent(...) construction; thinking level injected via abstract get_thinking_level() method; model_settings parameter removed from AgentBase
• LLM request timing — CustomLlmWrapper now logs duration for every request and streaming call
• Results extractor semaphore — Serializes extractor calls to prevent rate-limit errors under concurrent load
• Xray test management support — xray_client.py extended with fetch_ready_for_execution_test_cases_by_labels, create_test_execution, and supporting helpers
• Zephyr client hardened — Added create_test_plan, timestamp parsing, retry logic, and improved error handling
• Allure client extended — New test execution and reporting methods with retry support
• New agent skills — pr-review, run-unit-tests, and software-architect skills with full templates, ADR/decision matrix resources, and implementation plan scaffolding

Bug Fixes

• Fixed missing attachments in incident creation flow
• Fixed wrong error message on dashboard during login
• Fixed agent wait/recovery handling
• Fixed log viewer scrolling
• Fixed duplicate detection prompt template
• Fixed EndpointFilter to use getMessage() for reliable dashboard path matching
• Fixed LOG_SEPARATTOR typo → LOG_SEPARATOR

Refactoring

• Removed redundant MAX_RETRIES constant (now uses config.RetryConfig everywhere)
• Removed duplicate AgentRunResult import in agent_base.py
• AgentStatus, BrokenReason, TaskStatus now inherit from StrEnum
• usedforsecurity=False added to all hashlib.md5() calls (non-cryptographic use)
• GEMINI.md renamed to AGENTS.md; CLAUDE.md updated to reference it

Tests

• Fixed mock_httpx_client fixture to work with persistent AsyncClient (not context manager)
• Fixed method name: _ensure_collection → ensure_collection in two test files
• Fixed patch target: common.custom_llm_wrapper.Agent (was agents...main.Agent)
• Fixed placeholder assertions: == "MINIMAL" → == 0, == "LOW" → == 1001
• Added tests for allure_client, xray_methods, zephyr_methods, vector_db_service, utils

Documentation

• README updated with new dashboard endpoints (/api/dashboard/discovery, logs?offset=)
• README updated: Xray added to test management system integrations
• Dashboard feature descriptions updated to reflect pagination and discovery button

Dependencies

• python-dotenv 1.2.1 → 1.2.2 (CVE-2026-28684)
• requests 2.32.5 → 2.33.0 (CVE-2026-25645)
• pytest 9.0.2 → 9.0.3 (CVE-2025-71176)
• PyJWT 2.10.1 → 2.12.0 (CVE-2026-32597)

Configuration

• cloudbuild.yaml: Separated image build/push from Cloud Run deploy into distinct steps for better granularity and failure isolation
• cloudbuild.yaml: Added TZ=$_TIMEZONE env var to jira-mcp-server deployment

Testing

• All unit tests pass (139 passed)
• Linting passes (ruff)
• Security scan reviewed (bandit — 2 high-severity issues fixed, remaining are low-severity assert usage in tests)
• Dependency vulnerabilities checked (pip-audit — 4 direct deps bumped to patched versions)

Notes

Indirect dependency vulnerabilities in urllib3 (2.6.3), python-multipart (0.0.26), and pip (26.0.1) exist but are not pinned directly — they will be resolved when parent packages pull updated transitive deps. The test_attachment_handler.py test crashes due to a Windows-specific python-magic DLL access violation; this is a pre-existing environment issue unrelated to these changes.