#21337 feat: add durable Freestyle runtime promotion slice

What changed

Wire the first production runtime slice for cmux-next:

• durable Runtime lifecycle, leases, placement fences, and run_attempts.runtime_id
• persistent Freestyle workspace records and request-scoped VM workflow composition
• durable Run/Attempt/Event/Artifact API and Cloud VM dogfood worker
• promotion of a successful fan-out attempt into a persistent dev box while preserving terminal session identity
• idempotent promotion persistence, migration coverage, CI dependency installation, and DB-backed promotion tests

Validation

• bun install --frozen-lockfile
• bun run db:check
• bun run typecheck
• bun run lint:complexity
• focused runtime/workspace/promotion tests: 18 passed
• hosted web DB migration job passed on the branch

The protected staging workflow is included and ready to rerun after this branch is admitted by the staging environment policy.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Wires the first production runtime slice for cloud-vm: durable Run/Attempt/Event/Artifact APIs, persistent Freestyle workspaces, and promotion of a successful fan-out attempt into a persistent dev box that preserves terminal session identity.

New Features

• Persists runtime lifecycle, leases, placement fences, and run_attempts.runtime_id.
• Adds persistent Freestyle workspace records with request-scoped VM workflow composition.
• Adds Run API routes and a Cloud VM dogfood worker that claims attempts, launches detached terminals, and ingests events.
• Promotion is idempotent by request key and replay-safe; provider handles never cross the promotion view.
• Adds three DB migrations, a protected staging promotion suite workflow, and DB-backed promotion tests.