Add current Runtime observation API and agents-client support

[sam2tom]

Goal

Implement Phase 2 of Runtime observability as a read-only Core extension and expose it through packages/agents-client.

Scope

• GET /v1/agents/runtime-observations
• GET /v1/agents/sessions/{session_id}/runtime-observation
• tenant-scoped Session -> Environment -> Runtime allocation resolution
• stable Session-based keyset pagination
• explicit observed, unavailable, and unsupported states
• bounded concurrency and per-source deadlines
• cumulative CPU, optional derived CPU rate, memory, compute start time, and resolution/sample timestamps
• generated OpenAPI and extension coverage ledger updates
• strict Agents client parsing and pagination support

Boundaries

• no token duplication; Web joins canonical Session Usage by exact Session ID
• no history endpoint or PostgreSQL time-series table
• no lifecycle operations or idle-shutdown decisions
• no provider-native IDs, raw errors, credentials, host paths, or labels in responses
• no Kubernetes, E2B, or self-hosted telemetry source implementation in this issue

Acceptance

• foreign/missing Sessions and cursors remain indistinguishable
• observed zero is distinct from unavailable
• provider/integrity mismatches fail closed
• Runtime incarnation changes do not invalidate list pagination
• malformed pages are rejected by packages/agents-client
• raw HTTP, client, authorization, pagination, timeout, and race tests pass
• make check passes or any unrelated baseline blocker is documented with evidence

Design: contracts/agents-api/runtime-observability-design.md
API proposal: contracts/agents-api/runtime-observability-api.md
Depends on: #15