refactor(runtime): enforce canonical model execution boundary

[drewstone]

Purpose

Make Runtime the only executable model boundary: each real turn starts from one exact AgentProfile, uses a Runtime-owned executor, emits Runtime events, and preserves unknown usage as unknown.

Checkpoint status

This draft preserves the full migration while review continues. Root TypeScript currently compiles; the PR is not ready.

Remaining completion criteria

• Delete bridge and cli-worktree profile overlays so spec.profile is the sole authority.
• Require profile-owned model and reasoning on exact turns; reject seam conflicts before transport.
• Finish retry ownership and record exact HTTP attempt counts.
• Add router tool authorization regression; undeclared provider tool names never execute.
• Carry or refuse unknown usage through inlineSandboxClient; regression required.
• Migrate remaining executable direct provider probes and narrow static exceptions to model-free health checks.
• Prove AppWorld uses the generalized Runtime session path after deleting its local model loop.
• Add zero-request mismatch tests for prompt, model, tools, harness, resources, and bridge profile identity.
• Complete full typecheck, package tests, bench tests, build, static boundary check, critical audit, and current PR review.

No live Claude, Codex, DeepSeek, or GLM calls are part of this PR verification.

[drewstone]

Superseded by #736, which preserves this pull request's intended working-tree result on current main without the conflicted merge history. Continued review belongs on #736.

[drewstone]

Closing in favor of #736. The original dirty worktree and branch remain untouched.