Harden stable runtime for 1.0

[Jason-Doyle]

Summary

• define the stable Agent Intent 1.0 contract while preserving protocol 0.1 compatibility
• harden authorization, tenant isolation, database TLS, runtime roles, effects, artifacts, migrations, shutdown, metrics, and recovery
• add signed backup manifests, worker health, operational runbooks, and validated multi-cloud release gates
• regenerate the three-run SRE evidence from source commit dd9b422

Validation

• npm run release:check
• full PostgreSQL integration suite
• npm run deployment:check
• signed backup/restore drill
• Linux SIGTERM drain and startup-failure lifecycle tests
• three-run SRE benchmark regeneration and verification
• production container build and CLI smoke
• npm SPDX SBOM generation
• runtime dependency audit and GitHub security alert review

The 1.0.0 version bump and tag remain a separate release pull request after this merges.