Expose safe Core startup configuration in System

[sam2tom]

Summary

• add an authenticated, versioned GET /v1/agents/core/startup-configuration extension with a deterministic secret-free process configuration projection
• add strict agents-client parsing and render supported/configured harness, sandbox, gateway, self-hosted, and boolean LLM endpoint facts in System
• preserve Vault status and older-Core compatibility, fence stale connection reads, and update generated OpenAPI plus architecture/user documentation

Safety boundary

This endpoint reports startup configuration only. It does not expose raw endpoints, credentials, headers, paths, installation identifiers, daemon heartbeats, Runtime identities/capabilities, Session or Environment observations, or readiness claims.

Validation

• focused Go API/server/contract tests passed
• pnpm typecheck passed
• agents-client tests: 297 passed
• Web unit tests: 573 passed
• Playwright acceptance: 75/77 passed in the full run; the two remaining cases hit concurrent trace-artifact ENOENT collisions and both passed immediately when rerun serially
• generated OpenAPI refreshed; git diff --check passed
• independent blind review completed twice; final review found no blockers
• make check was run with a dedicated temporary PostgreSQL 16 database and passed database, SQLC, Go, Agents API, SDK, Web build, and browser gates; its final unchanged Rust executor gate does not compile on macOS because of existing Linux-specific st_dev/OFlags::PATH usage

Fixes #28

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}