feat: harden OIDC and managed runtime delivery (AXI-182)

[Codename-11]

Summary

• enforce PKCE, state, and nonce for generic OIDC and verify a standards-strict linking flow
• add explicit identity-link confirmation, relink coverage, and a separately designated break-glass principal
• route manual runtime diagnostics through the worker execution plane with durable executor/trigger history
• label managed Hermes runtimes from adapter/transport identity and deduplicate reachability failures
• add a stable Hermes adapter User-Agent, sanitized HTTP diagnostics, and release-packaged presence/provision helpers
• document reverse-proxy OIDC requirements and reference worker egress networking
• pin the BODY completion-comment contract and cover the full managed run lifecycle end to end

Verification

• fresh combined migration chain applied successfully
• lint, typecheck, Prisma validation, and production build passed
• existing Playwright matrix: 60 passed, 1 intentional skip
• strict generic OIDC linking flow after cache fix: 1/1 passed
• runtime diagnostics/lifecycle/health/dispatch/MCP focused suites: all green
• Hermes Python adapter: 10/10 passed
• helper packaging and shell syntax checks passed

Implements AXI-182. AXI-181 is expected to merge first; this branch must then absorb current main and rerun exact-head CI before merge.