feat: dispatch immutable external runtime profiles

[pilprod]

Summary

• overwrite the reserved top-level A2A metadata with the exact persisted prepared revision profile after authentication
• reject message-level spoofing and reserved metadata on substrate instances
• include the injected profile in initial-task idempotency and preserve it for streaming and HITL replies
• require the private local Agent Card capability with exact params before create/resume
• fail closed on malformed revision/profile identity and unsupported logical tools
• remove the private profile extension from the public kagent Agent Card

Trust boundary

Callers cannot supply the instruction. kagent resolves the authenticated AgentInstance, loads its immutable prepared RuntimeRevision, validates backend identity, and replaces the reserved metadata value before hashing or dispatch. The reverse channel carries the resulting JSON-RPC request without credentials or endpoint material.

Verification

• go test -race -count=1 ./core/v2/externalprofile ./core/v2/a2agateway ./core/v2/externalruntime ./core/v2/mcp ./core/cmd/controller-v2 ./core/v2/controller ./core/v2/translator/... ./core/internal/grpcserver ./core/v2/runtimebackend
• matching targeted go vet
• broker JSON-RPC propagation coverage
• git diff --check

Stack and release gates

This PR is stacked on #9 and must ship with local-agent-host PR #3. The PostgreSQL migration-19 round trip from #9 and live reverse-channel end-to-end test remain release gates. Fork GitHub Actions currently fail before execution because the account is locked by a billing issue; local checks above pass.