PR: test: supplement coverage for LLM env resolution and control paths

[metasmile]

Final coverage supplement for the actus session work (issues #15-#19).

Scope

• Extract the LLM endpoint resolution (env precedence, quote stripping, empty defaults) from main.rs into agent::config::resolve_llm_settings/unquote_env_value and cover it with unit tests, so the issue actus: rename hardcoded deepseek references to OpenAI-compatible API naming #16 rename semantics (env-driven provider/model/base URL, no vendor defaults) are pinned.
• Assert the injected language_models.openai_compatible entry values in the settings-schema test (neutral label, base URL, model).
• Extend the ext_cli adapter tests: agent-wide cancel kills all running turns, cancel-after-completion is a no-op, the launch probe accepts a hanging binary within the grace window, and status reports a binary removed after construction.
• Extend the HTTP control tests: policy-denied controller cancel, and human submits without identity never record a parent thread.

Status

• 109 tests pass locally; ./run.sh --test (prebuilt telos, real agent) passes end to end; cargo fmt --check clean on the changed files.
• Earlier session commits for issues Trial Ante as an auxiliary agent over its raw CLI transport #15-meta-agent control: let telos dispatch ext_cli agents through a policy-gated MCP control surface #19 (aux agent hardening, control MCP proxy, parent tagging) are already on main; this PR carries the remaining local commit only.
• Live meta-agent dispatch (issue meta-agent control: let telos dispatch ext_cli agents through a policy-gated MCP control surface #19-3) remains blocked on upstream telos issue actus: approval system and async task lifecycle #6 (headless agent ignores --user-data-dir); see meta-agent control: let telos dispatch ext_cli agents through a policy-gated MCP control surface #19 and headless agent main ignores --user-data-dir: actus-injected settings never load telos#6.

Verification

• cargo test: 109 passed, 0 failed
• ./run.sh --test: all checks passed (telos connected, agent ready)
• CI: the standard test workflow runs this branch head on push.