feat(v0.6): --agent flag on ctask new selects agent type

Resolver gains SetCLIFlagAgent; DefaultAgent now layers CLIFlag above
EnvVar so doctor/info attribution renders the correct precedence chain
(CLIFlag overrides EnvVar overrides ConfigFile overrides Builtin).

ctask new --agent <type> writes agent.type into the new workspace's
task.yaml. Resolution and validation run before workspace.Create, so
--agent custom without a companion command refuses ("type custom
requires command") with no half-created workspace left on disk. The
deferred Phase 1 test TestCLIFlagOverridesEnvVar lands here.

--agent on resume/last/attach is unchanged (one-shot agent.command
override on the AgentSpec — Open Q 1).

cmd/new.go

@@ -35,7 +35,7 @@ func init() {
 	newCmd.Flags().BoolVar(&newProject, "project", false, "Create a project workspace (longer-lived; uses CTASK_PROJECT_ROOT if set, runs git init)")
 	newCmd.Flags().BoolVar(&newContainer, "container", false, "Launch in container sandbox (deferred)")
 	newCmd.Flags().BoolVar(&newShell, "shell", false, "Open interactive shell instead of agent")
-	newCmd.Flags().StringVarP(&newAgent, "agent", "a", "", "Command to exec as the agent")
+	newCmd.Flags().StringVarP(&newAgent, "agent", "a", "", "Agent type for the workspace (claude, opencode, custom)")
 	newCmd.Flags().BoolVar(&newNoLaunch, "no-launch", false, "Create workspace only, do not launch")
 	newCmd.Flags().BoolVar(&newDirect, "direct", false, "Bypass persistent session mode for this command")
 	rootCmd.AddCommand(newCmd)
@@ -54,12 +54,22 @@ func runNew(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	// Task 3: minimal wiring — the --agent type-selector rework lands in
-	// Task 4. For now the resolved type drives both the workspace AgentSpec
-	// and the launch-time agent.Resolve.
-	agentType := newAgent
-	if agentType == "" {
-		agentType = config.ResolveAgent()
+	// --agent on `new` is a type selector (v0.6 spec §5): the resolved
+	// type is recorded in task.yaml and drives the launch. SetCLIFlagAgent
+	// layers the flag above CTASK_AGENT / config / builtin so doctor and
+	// info can render the precedence chain. Resolution and validation run
+	// BEFORE workspace.Create so an invalid agent (unknown type, or
+	// `--agent custom` with no command) refuses without leaving a
+	// half-created workspace on disk.
+	resolver := config.LoadResolver()
+	if cmd.Flags().Changed("agent") {
+		resolver.SetCLIFlagAgent(newAgent)
+	}
+	agentType := resolver.DefaultAgent().Value
+	spec := workspace.AgentSpec{Type: agentType}
+	resolved, err := agent.Resolve(spec, agentType)
+	if err != nil {
+		return err
 	}
 
 	title := ""
@@ -96,7 +106,7 @@ func runNew(cmd *cobra.Command, args []string) error {
 		Title:           title,
 		Category:        category,
 		Mode:            "local",
-		AgentSpec:       workspace.AgentSpec{Type: agentType},
+		AgentSpec:       spec,
 		IsProject:       newProject,
 		SeedDir:         config.ResolveSeedDir(),
 		SkipCategoryDir: skipCategoryDir,
@@ -131,11 +141,6 @@ func runNew(cmd *cobra.Command, args []string) error {
 		return nil
 	}
 
-	resolved, err := agent.Resolve(workspace.AgentSpec{Type: agentType}, agentType)
-	if err != nil {
-		return err
-	}
-
 	// Re-set the workspace's root: workspace.Create returned ws but our
 	// computed `root` is what should be exported via CTASK_ROOT (it may
 	// differ from ws-derived defaults when --project + CTASK_PROJECT_ROOT