refactor(runtime): separate product workflows from Agent Runtime

[limityan]

Summary

• define the six-layer dependency direction and the concrete Agent Runtime inclusion/exclusion boundary
• make Product Assembly select profile-scoped built-in Agent IDs and atomic tool groups
• keep CLI, ACP, and SDK Host on the Code Agent capability without DeepReview, DeepResearch, MiniApp, or Canvas registration
• move deterministic DeepResearch report policy into the minimal agent-workflows crate
• remove the unused Harness descriptor/registry preview surface instead of extending a second workflow runtime

Architecture boundary

Owner	Responsibility
Apps / Interfaces	entrypoint and protocol adaptation
Assembly	Delivery Profile, Agent catalog, atomic tool-group, and provider selection
Adapters	external protocol and provider translation
Services	filesystem, Git, terminal, network, MCP, remote, and other concrete I/O
Agent Runtime	portable Agent / Session / Turn lifecycle, scheduling, cancellation, recovery, context-model-tool loop, permissions, events, usage, checkpoints, and generic extension contracts
Agent Workflows	named product workflow policy built above the Runtime
Contracts	stable DTOs, events, facts, and ports

Dependencies flow downward. agent-runtime cannot depend on named product workflows. MiniApp and Canvas remain product artifact capabilities. Delivery Profile selection remains in Assembly.

The production loop is still owned by assembly/core through ConversationCoordinator -> Scheduler -> ExecutionEngine -> RoundExecutor -> ToolPipeline. This PR does not claim that owner migration is complete and does not move the roughly 11k-line DeepReview implementation.

Compatibility and behavior

• ProductFull retains the complete built-in Agent catalog.
• The existing observable tool registration order is preserved; atomic groups control inclusion only.
• The Rust Runtime SDK preview API version moves from v7 to v8 because Harness exports, builder injection, and provider-ID queries are removed. Preview embedders should remove those unused calls; Product Assembly now owns named workflow selection.
• No npm or PyPI package is published.
• No custom-tool API is added.

Scope

• 1 commit
• 932 additions, 1,502 deletions; 2,434 changed lines total
• most touched files are boundary checks, documentation, renames, or deletion of the unused Harness scaffold
• no files under docs/superpowers/**

Validation

• node scripts/check-core-boundaries.mjs
• boundary self-test mode
• node --test scripts/check-core-boundaries.test.mjs (126 passed)
• pnpm run check:repo-hygiene
• cargo test --locked -p bitfun-tool-packs
• cargo test --locked -p bitfun-agent-workflows
• cargo test --locked -p bitfun-product-capabilities --test product_capability_contracts
• Agent Runtime SDK smoke contracts (9 passed)
• focused Core ProductToolRuntime, registry-order, profile Agent catalog, and minimal-runtime tests
• cargo check --locked -p bitfun-cli
• cargo check --locked -p bitfun-sdk-host-app
• cargo check --locked -p bitfun-acp --no-default-features --features server
• dependency-closure audit for CLI, SDK Host, and ACP server