feat: expose live Shift sessions to local agents

[kostyafarber]

Summary

• add an authenticated loopback MCP code-mode interface for listing live Shift sessions and inspecting an explicitly targeted editor
• execute agent-authored code in a dedicated utility process with bounded QuickJS memory, stack, source, result, and execution time
• establish @shift/runtime as the host-neutral capability contract, backed by canonical identity and session types and re-exported through the SDK
• route editor observations through typed main/preload/renderer lanes and document the workflow in a synchronized agent skill

Issue

Closes #488

Testing

• pnpm typecheck
• pnpm lint:check
• pnpm format:check
• pnpm deadcode:strict
• pnpm test
• pnpm --filter @shift-editor/sdk test:packed
• pnpm --filter @shift/desktop build:e2e
• pnpm --filter @shift/desktop exec playwright test e2e/live-agent.spec.ts --project=platform
• pnpm agent-skills:check
• node scripts/check-e2e-projects.mjs
• python3 scripts/context-drift-check.py — no structural errors; exits non-zero for 17 existing documentation review-date warnings

Risks

• the initial capability surface is intentionally read-only; font mutation, glyph snapshots, and canvas capture remain follow-up work
• the local bearer descriptor grants same-user access while Shift is running and is therefore stored with 0600 permissions and removed on graceful shutdown