[codex] Forward Northbound agent runs to Runtime

[hhhhsc701]

What changed

• Add Runtime internal agent run and stop endpoints with strict request validation.
• Add a managed Northbound Runtime HTTP client with request ID propagation, SSE proxying, timeout/error mapping, and deterministic upstream cleanup.
• Route REST Chat and A2A synchronous, streaming, and cancellation execution through Runtime without forwarding external authorization or falling back to local execution.
• Add the shared agent SSE interruption contract and focused unit/integration-style tests.

Why

Northbound should remain the authentication and orchestration boundary while all agent execution happens in Runtime, including multi-replica deployments.

Impact

Agent run and stop operations require Runtime availability. Runtime 4xx responses are preserved, 5xx responses map to 502, and connection failures map to 503.

Validation

• 131 targeted backend tests passed.
• git diff --check passed.

Known follow-up

• A Runtime failure before the first A2A event should persist the already-created task as TASK_STATE_FAILED before returning the proxy error.

Stack

Stacked on dev/helm-release-split; review this PR against that branch.