feat: compile and persist external runtime harnesses

[pilprod]

Summary

This is the third PR in the external-runtime stack and is based on #7.

• compile codex and claude Harnesses into canonical, credential-free v1 profiles
• persist immutable external profiles in runtime revisions with a new migration 19
• reconcile external revisions without creating Substrate WorkerPools or ActorTemplates
• publish ExternalRuntimePrepared only after the database accepts the revision and latest-success edge
• package the reverse gateway behind a disabled-by-default, single-replica Helm configuration
• create a dedicated internal-only ClusterIP Service and mount the device token only from an existing Secret
• document the profile boundary, current limitations, and rollout constraints

Security and compatibility

• external profiles contain only instruction plus logical MCP server/tool allowlists
• ModelConfig data, Secret values, MCP URLs, headers, TLS material, and local execution settings are excluded
• workload, substrate, and env are forbidden for external Harnesses
• skills, plugins, shared agents, MCP headers/TLS, and empty tool allowlists fail closed
• gateway HTTP, gRPC, metrics, and controller Service port collisions are rejected by Helm
• migration 18 remains byte-identical; profile storage is isolated in migration 19
• migration 19 preserves runtime/profile/source across 19 -> 18 -> 19 and 19 -> 17 -> 19, while a destructive rollback below migration 8 cleanly removes revision data
• stale status derivations and superseded UID/generation/revision acknowledgements cannot overwrite the persisted status edge

Verification

• go test -race ./api/v1alpha3 ./core/v2/controller ./core/v2/translator/... ./core/internal/grpcserver ./core/cmd/controller-v2 ./core/v2/externalruntime ./core/v2/runtimebackend
• targeted go vet for the changed packages
• migration static guards and compilation of migration/database test binaries
• query contraction checks for v0.10.0-rc1 and v0.10.0-rc3
• generated clientset, deepcopy, sqlc, and CRDs reproduced without drift
• Helm: 22 suites / 300 tests, strict lint, enabled/disabled rendering

Draft / merge gates

• Do not deploy this PR by itself. Request profile injection and the strict local Codex/Claude consumer are intentionally delivered in the next stacked PR; without them, the persisted instruction/tools are not yet executed.
• Run the migration 19 PostgreSQL round-trip tests in CI before merge. The local host has no PostgreSQL server or rootless container runtime, so those tests were compiled but could not execute locally.
• Do not roll mixed migration-18 and migration-19 controller replicas. Release the combined stack with Recreate; the gateway-enabled chart enforces that strategy.
• GitHub-hosted checks may report the fork account billing lock independently of code status.