ADR-018: Remove AI SDK, use openai SDK directly with hub-own streaming

Replace the Vercel AI SDK with direct OpenAI SDK calls and a custom
AgentLoop. The AI SDK has zero runtime integration today, so removing
it costs nothing. Supply chain risk (2-5 releases/day, April 2026
Vercel breach, bus factor of 1) makes it a liability we don't need.

Key changes:
- ADR-018 accepted: openai package (zero runtime deps) replaces ai SDK
- AgentLoop handles multi-step tool execution explicitly (~300 LOC vs
  AI SDK's ~2700 LOC streamText)
- Hub owns UIMessage/UIPart/ToolCallState types (extends ADR-016)
- Hub owns streaming protocol (subset of AI SDK's UIMessageChunk wire
  format with step boundaries, error handling, usage tracking)
- operationToOpenAITool() maps TypeBox schemas directly, no adapter
- Trade-off: ~1100 LOC total new code for the savings of 6+ transitive
  deps, supply chain risk, and release cadence coupling

Updates AGENTS.md constraints and dependencies, adds OQ-63/OQ-64/OQ-65
and Theme 11 (Inference & LLM Integration) to open questions.

AGENTS.md

@@ -18,7 +18,7 @@ src/
   auth/         — API key auth (keypal), session tokens
   coordination/ — coord.spawn/status/message/notify/abort/detect
   redis/        — Redis EventTarget setup, event routing
-  inference/    — OpenAI-compatible proxy, LLM key management
+  inference/    — OpenAI-compatible proxy, LLM key management, AgentLoop, hub-own streaming
 docs/
   architecture/ — Architecture specs (see overview.md for index)
   decisions/    — ADRs
@@ -43,6 +43,7 @@ migrations/     — Drizzle SQL migrations
 | `drizzle-orm` | 0.45.2 | Postgres ORM |
 | `ioredis` | 5.10.1 | Redis client |
 | `keypal` | 0.2.0 | API key management |
+| `openai` | TBD (pin on add) | OpenAI API client for LLM calls (zero runtime deps) |
 | `pg` | 8.21.0 | Postgres driver |
 | `@hono/mcp` | 0.3.0 | MCP server middleware |
 | `@logtape/logtape` | 2.1.1 | Structured logging |
@@ -79,7 +80,7 @@ deno lint
 - Deno runtime (latest stable), TypeScript strict mode
 - Postgres for all persistent state (Drizzle ORM)
 - Redis for cross-process events (ioredis)
-- AI SDK (`ai` package) for LLM streaming (not Effect)
+- OpenAI SDK (`openai` package) for LLM calls — no AI SDK (see ADR-018)
 - TypeBox for all runtime schemas (`@alkdev/typebox`, not Zod or @sinclair/typebox)
 - Hono for HTTP server
 - WebSocket for hub<->spoke transport (not SSE as primary)