Move saved Agents into the agents domain and agentpg adapter

[SaladDay]

Part of #1 (store layering), PR 10. Moves saved Agents out of store into the agents domain and its agentpg adapter.

• internal/agents: Service (Create/Update/Delete) owns the rules:

  • configuration create and merge, including the harness_config reset
  • patch decoding
  • the 512 KiB bound
  • model-execution validation
  • metadata and JSON object normalization

  Storage updates in the Load → Decide → Apply shape (WithAgentUpdate). Reader serves the reads. The domain imports no persistence.

• persistence/postgres/agentpg:

  • Seals the provider bundle with the tenant and Agent binding.
  • Records write audit in the same transaction.
  • Resolves path IDs and cursors with pgunit.PathID.
  • Translates only unstorable text; other errors pass through.

• api:

  • Adds Agents and AgentsReader dependencies, writeAgentsError and strict fakes.
  • /core/v1 list and delete use the same operations as /v1.
  • Session creation decides which Agent read to use.

• Deleted from store: agents.go, agents_delete.go, agents_list.go, agents_update.go, agent_model_execution.go and their tests. The sqlc query GetAgentForSession is renamed GetAgentWithModelExecution.

Pinned /v1 behaviour is unchanged: make openapi shows no diff and the official-client tests pass. Internally:

• A malformed Agent ID is not-found inside the adapter (the handlers already answered 404).
• A list reads its cursor and page in one snapshot.
• Creating an Agent without a model provider no longer issues a DELETE.

Checks

Check	Result
go build ./..., go vet, check-names.py, check-sqlc.py, make openapi	pass
agents	12 passed
agentpg (PostgreSQL)	10 passed, 0 skipped
auditpg	8 passed
api	311 passed
cmd/...	pass
full store package with the official SDK	535 passed, 13 opt-in skips

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}