#21502 Add Huge Blue provider relay and attach tokens

Adds the focused Huge Blue provider and relay boundary on top of the runtime receipt layer in #21456. The slice includes the provider driver, hashed rotating attach tokens, the token migration, and the repo-owned loopback relay/systemd deployment files.

Tokens are opaque, short-lived, hash-only at rest, bound to the persisted workspace owner/tenant/host/session, and revoked on rotation or lifecycle changes. The relay fails closed on authorization or database errors and rechecks expiry and revocation during an open link.

Validation:

• provider, relay, and attach-token tests passed (8/8)
• Drizzle migration check passed
• web complexity check passed
• full typecheck remains blocked by the current Freestyle-only provider enums and composition root; the follow-up composition PR will wire Huge Blue into authenticated runtime composition

Depends on #21456. This PR does not deploy or alter production.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds Huge Blue provider and relay support, including authenticated attach with hashed rotating tokens and provider-routed persistent workspaces. The brokered lifecycle replays remote host effects and fails closed when provider config or stored state does not match.

• Persists runtime and workspace lifecycles by provider, routes create requests through authenticated composition, and rejects unknown or mismatched providers before effects run.
• Issues short-lived attach tokens whose raw value is stored only as a hash; the loopback relay rechecks authorization on upgrade and while links stay open.
• Promotes successful run attempts into Huge Blue workspaces and validates sanitized broker receipts into run events.
• Includes isolated relay, provider, staging API, and soak harness units; no production deployment.