Add the Kotlin and Java language servers and oras to the container setup script

[ExtraToast]

Follow-up to #60, whose container setup script leaves out three tools the agents image may still want.

What to build

• kotlin-lsp and jdtls: the estate is largely Kotlin, so Agent Sessions lose code intelligence without them. Neither publishes a Linux artifact at a single pinnable URL. kotlin-lsp ships a .vsix whose name carries two version numbers, and jdtls milestones carry a build timestamp. Each needs a container: block whose install derives its URL from one Renovate-tracked version, plus a version_command that proves the server, not just a JDK, is present.
• oras: the old runner image used it to fetch the agent-kit runtime-home. Decide whether the agents image still needs runtime-home. If it does, add oras with a pin. If not, record why it was dropped.

Acceptance criteria

• kotlin-lsp and jdtls install in a clean Debian container on amd64 and arm64, and setup-container.sh --check verifies each at its pin.
• Renovate tracks both pins, and the existing coverage test passes.
• oras is either added with a pin or its removal is documented in the registry.

Blocked by

• Generate a Linux container setup script from the tooling registry #60