#21503 Add independently deployable broker worker adapters

Builds the independently deployable agent-broker worker on top of the runtime receipt layer in #21456. It owns the versioned adapter boundary, durable worker entrypoint, host-lease adapters, container/systemd packaging, and Big Red staging build path.

The worker receives credential-free envelopes and resolves provider credentials only from deployment configuration. The lease client keeps replay/fencing behavior in the shared runtime contract; unknown host classes fail closed.

Validation:

• worker and adapter harnesses passed
• host lease focused tests passed (18/18)
• adapter tests passed (3/3)
• complexity and diff checks passed
• full typecheck was attempted but terminated after the existing large workspace compiler remained CPU-bound

Depends on #21456. No production deployment is included.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds an independently deployable agent-broker worker and the durable runtime seam it drives: claims generation-fenced jobs, runs them through versioned provider adapters, and writes sanitized receipts back to the ledger. Provider credentials stay in deployment configuration and adapters only; they never cross the job envelope or receipt boundary. Successful run attempts can be promoted into persistent workspaces under the same fencing rules.

• Adds durable broker jobs, receipts, and host leases with generation fencing; expired leases are reclaimable and stale receipts are rejected.
• Adds a versioned adapter boundary and worker loop with lease renewal, fail-closed host-class matching, and serialized result checks.
• Adds Huge Blue and Freestyle host-lease adapters over HTTPS or SSH with flock-based fencing; missing credentials fail closed, and receipt metadata is scrubbed of secrets.
• Persists runtime lifecycle, lease, and idempotency columns, projects broker receipts into run events, and exposes workspace lifecycle routes and run-attempt promotion with terminal-winner fencing.
• Ships container and systemd packaging plus a Big Red staging build script; no production deployment is included.