#21444 feat(cloud): add authenticated Run API adapter

Outcome

Adds the first authenticated Run API surface to cmux Cloud, reusing the existing Stack auth, database, VM admission, Freestyle provider, and cleanup lifecycle.

What changed

• POST /api/runs accepts a secret-free cmux.run/v1 spec with idempotency.
• GET /api/runs and GET /api/runs/:id return tenant-scoped redacted receipts.
• Runs, attempts, and ordered events persist through the existing cloud database.
• The first attempt provisions through /api/vm, executes a bounded receipt command, and destroys the VM before terminal success.
• RunSpec validation rejects provider credentials and requires immutable source/setup digests.

Validation

• bun test services/runs/spec.test.ts — 3 passed.
• Existing managed staging Freestyle journey remains the provider/terminal dogfood path.
• No new secrets or provider bindings are introduced.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds the first authenticated Run API to cmux Cloud: POST /api/runs creates and synchronously executes the first attempt of a durable run, and GET /api/runs and GET /api/runs/:id return tenant-scoped receipts with attempts and ordered events.

• Runs persist through new runs, run_attempts, and run_events tables; Idempotency-Key replays the same RunSpec and returns 409 on conflict.
• The first attempt provisions a VM through the existing authenticated lifecycle, runs a bounded receipt command, and destroys the VM before terminal success or failure.
• The cmux.run/v1 spec is secret-free: validation rejects credential fields and requires a source commit or archive digest.
• Schema additions keep existing cloud tables untouched, so the migration drops in without affecting current builds.

Summary by CodeRabbit

• New Features
  • Added authenticated APIs to create runs, retrieve individual run details, and list recent runs.
  • Run requests support idempotency: repeating a request with the same key and specification returns the existing run; reusing the key with a different specification returns a conflict.
  • Run receipts include attempt statuses and events, with validation errors and execution outcomes reported in the response.
• Validation
  • Run specifications are checked for required inputs, valid variants, and sensitive values before execution.