fix: use effectivePreferredProfile for lockedProfileId derivation

Addresses Greptile review feedback: lockedProfileId now derives from
effectivePreferredProfile instead of raw preferredProfileId, ensuring
per-agent auth bindings take priority over session-level overrides.

Added integration test for per-agent binding vs user-locked profile
scenario.

src/agents/auth-profiles/order.test.ts

@@ -72,6 +72,41 @@ describe("resolveAuthProfileOrder", () => {
 
     expect(order).toEqual(["openai:account1"]);
   });
+
+  it("per-agent binding overrides session-level profile via effectivePreferredProfile", () => {
+    // Simulates the integration scenario where a per-agent binding (account2)
+    // should take priority over a session-level preferred profile (account1).
+    const store: AuthProfileStore = {
+      version: 1,
+      profiles: {
+        "openai:account1": {
+          type: "api_key",
+          provider: "openai",
+          key: "sk-1",
+        },
+        "openai:account2": {
+          type: "api_key",
+          provider: "openai",
+          key: "sk-2",
+        },
+      },
+    };
+
+    // Session requests account1, but per-agent config binds to account2.
+    const sessionPreferred = "openai:account1";
+    const agentAuthBinding = "openai:account2";
+    const effectivePreferred = agentAuthBinding || sessionPreferred;
+
+    const order = resolveAuthProfileOrder({
+      store,
+      provider: "openai",
+      preferredProfile: effectivePreferred,
+    });
+
+    // Per-agent binding (account2) must come first, not the session override (account1)
+    expect(order[0]).toBe("openai:account2");
+    expect(order).toContain("openai:account1");
+  });
 });
 
 describe("AgentEntrySchema auth field", () => {

src/agents/pi-embedded-runner/run.ts

@@ -420,7 +420,8 @@ export async function runEmbeddedPiAgent(
       )?.auth?.[normalizedProvider];
       const effectivePreferredProfile = agentAuthBinding?.trim() || preferredProfileId;
 
-      let lockedProfileId = params.authProfileIdSource === "user" ? preferredProfileId : undefined;
+      let lockedProfileId =
+        params.authProfileIdSource === "user" ? effectivePreferredProfile : undefined;
       if (lockedProfileId) {
         const lockedProfile = authStore.profiles[lockedProfileId];
         if (