refactor(execution): split sandboxed and host Command Runtime adapters

[Qiyuanqiii]

Refs #134

Summary

• Introduce exact Go-owned Command Runtime adapter identities for sandboxed_workspace, host_unsandboxed, and read-only legacy_unbound, including backend identity/generation, isolation grade, and effective network/credential policy.
• Enforce the permission matrix end to end: workspace adapters require workspace_access; host execution requires full_access; legacy evidence can never execute or be adopted after restart.
• Bridge the Windows Local AppContainer/LPAC and fixed Docker Standard Code paths into the shared command-runtime.v2 Job/cursor/Artifact contract, with no host fallback and fail-closed lease/profile/permission/root/backend drift checks.
• Persist adapter authority and receipts in schema v131. Preserve upstream schema v130 item-stream response/item/call identities and immutable triggers while projecting pre-v131 Command Runtime Jobs as legacy_unbound.
• Expose the three readiness layers consistently through CLI, HTTP, Desktop, OpenAPI, and Web: protocol availability, installed/ready adapter, and whether the current Run actually has the tool.

Validation

• go test -p 1 -count=1 -timeout 30m ./...
• go vet -p 1 ./...
• go test -p 1 -count=1 -timeout 15m ./internal/store -run 'TestSchemaV116AndV120PreserveAuthorityAndAdmitRuntimeTools|TestSchemaV127|TestSchemaV128|TestSchemaV129|TestSchemaV130|TestSchemaV131|TestSupervisorToolBatchAndResultEventsAreAtomicAndReplayable'
• npm run typecheck
• npm test — 68 files / 312 tests
• npm run check:api
• npm run build

Incomplete — follow-up before closing #134

• The host adapter preserves bounded stdin support. The current Local and Docker sandbox bridges intentionally accept closed stdin only and report this through incomplete_reasons; interactive sandbox stdin still needs a backend-owned implementation and lifecycle matrix.

This remains a Draft and intentionally references rather than closes #134 until that sandbox stdin gap is resolved.