feat(agents): register external Hermes runtimes

[camelludo]

What

• add a provenance-only external Hermes runtime register with owner-attested NIP-OA metadata
• project registered and archived runtimes as owner-signed relay events without importing keys, starting processes, or granting business authority
• expose register/list/archive controls and an E2E bridge test path in the Agents view

Why

This establishes one identity -> one runner owner -> one shutdown path while preventing duplicate local executors. Registration is fail-closed on conflicting managed-agent or relay provenance and defaults to mention-only, allowlisted, filtered, rate-limited metadata.

Safety / scope

• no private keys, providers, subprocesses, MCP authority, membership mutation, compute, external sends, Stomaton writes, or production changes
• archive preserves provenance history; it does not claim runner stop or access revocation
• GitNexus reports high risk because the desktop startup/managed-agent path is touched; the change is intentionally isolated and covered below

Checks

• cargo fmt --all -- --check
• cargo test external_runtimes --lib (5 passed)
• pnpm test (4286 passed, 0 failed)
• pnpm exec biome check on changed TypeScript/E2E files
• pnpm typecheck
• pnpm build:e2e
• Playwright integration: external runtime register provenance-only + built-in catalog (2 passed)

Follow-up

The real non-production Kaya stop -> membership revoke -> archive canary remains a separate operator-controlled proof and is not claimed by this PR.

[wolfyy970]

The provenance-only boundary is useful, but I do not think one identity to one live runner scope should become a platform invariant. #4861 provides a real fleet case where one persistent identity legitimately has several device and runtime instances. The portable identity and each runner claim are different objects.

Could this be an instance claim keyed by agent identity plus deployment scope, while kind:30177 remains the agent definition or announcement? That would still reject duplicate executors within one scope without forbidding multi-device identity.

The branch also carries workflow lifecycle and approval changes. Splitting those out would make the external-runtime boundary much easier to review on its own.