Refactor app-agent lifecycle and package source management

[curtisman]

Summary

• replace the broad app-agent host mutation surface with a callback-scoped provider-set controller that serializes changes under the dispatcher command lock, rejects invalid/reused capabilities, and emits notifications from each run’s net effect
• vend installed agents through a connected dynamic source with shared per-agent providers and coordinated cross-session install, update, and uninstall behavior, including late-join handling, bounded rollback, refcount verification, and version-scoped install-root cleanup
• preserve per-session enablement settings when uninstall rolls back by finalizing config cleanup only for a net removal
• gate update and uninstall commit on the durable agents.json write; a write failure now selects rollback and restores v1 before sessions resume
• report package update/uninstall initiation and rollback outcomes, preserve update enablement settings, and group installed and available agent listings by configured source
• update lifecycle, embedding-dispatcher, and default-agent-provider documentation for the new source/controller contracts