Add current Runtime observation API and client

[sam2tom]

Summary

• add tenant-scoped current Runtime observation list and Session retrieval endpoints
• expose strict packages/agents-client discriminated types, validation, pagination, and generated OpenAPI
• preserve Docker observed-zero semantics, bounded read-only sampling, complete identity fencing, and safe unavailable reasons

Stack

• Depends on Add Docker Runtime observations and public read API #15, which provides the provider-neutral Runtime observation and Docker sampling foundation.
• Implements Add current Runtime observation API and agents-client support #19. The issue should close after the stack lands on the default branch.

Boundaries

• no database migration or time-series table
• no token duplication, lifecycle actions, history endpoint, or Web Dashboard implementation
• no Kubernetes, E2B, or self-hosted telemetry source

Verification

• make check-agents-api
• focused Go tests for API, runtimeobs, Docker, and server
• focused Go race tests for API, runtimeobs, and Docker
• agents-client TypeScript typecheck and 248 tests
• sqlc, Go, Claude SDK, Core Web including 73 Playwright cases, and MiniMax harness checks
• independent blind review after fixes: no findings

Full make check remains unavailable locally because PARSAR_AGENTS_API_TEST_DATABASE_URL is not configured. The unrelated macOS Rust executor baseline also fails on OFlags::PATH and st_dev platform types; this branch does not modify packages/codex-executor.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}