fix(agentos): accept [ as a package command name

[eersnington]

• The coreutils package declares the command [ (POSIX test). The resolver allows only A-Z a-z 0-9 - _ . @ in command names, so resolving any software list that includes coreutils fails.
• [ is now accepted as an exact name. Other names with brackets ([x, ]) and path separators are still rejected.

for command in &manifest.commands {
    // `[` is the POSIX name of `test`. It contains no path separator.
    if command.command != "[" {
        validate_manifest_component("command", &command.command, MAX_PACKAGE_COMMAND_BYTES)?;
    }
    validate_relative_manifest_path("command entry", &command.entry)?;
}

Code: crates/client/src/software.rs

---

This is part 1 of 4 in a stack:

•  4  fix(agentos): route CompareVmConfig through the sidecar request loop #2018
•  3  perf(agentos): batch chunked_sqlite index saves into transactions #2017
•  2  fix(agentos): keep chunked_sqlite metadata pieces under the remote SQLite bind limit #2016
•  1  fix(agentos): accept [ as a package command name #2015 👈

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.

[the-company-company]

✅ No issues found

_{Reviewed commit 118abe8.}

[the-company-company]

🔴 1 high-severity finding

_{Reviewed commit 3a81572.}

[the-company-company]

🔴 High · Keep existing 256 KiB metadata generations readable

Reducing this constant also changes load_metadata's format validation: it recomputes expected_chunks with 64 KiB and rejects any loaded chunk larger than 64 KiB. A database written by the previous release with, for example, a 100 KiB dump has one 100 KiB chunk, so reopening it now fails before the filesystem can mount. Keep the write chunk size at 64 KiB, but make the reader accept the legacy 256 KiB layout (or version and migrate the stored format) so persisted VMs survive the upgrade.

[eersnington]

i knew you'd flag this you little 💩

there is no legacy metadata. this is not even released api dawg