refactor(agent): converge runtime control, tool AOP, and timeline

[M09Ic]

Summary

This follows up PR #62 by removing the parallel mechanisms left around the canonical Agent path:

TUI / stdio / WebSocket -> AgentRuntime -> Session -> Run / Command -> AOP

• make AgentRuntime the single owner of sessions, runs, cancellation, and draining
• expose one stateless Runtime protocol dispatcher to stdio and WebSocket
• route direct tool execution exclusively through AOP tool.call/tool.result
• remove unused Run replay storage, context-free handoff helpers, legacy Agent timeline envelopes, and intermediate command payloads
• keep product events on the narrowed DomainEvent plane
• keep terminal/Markdown presentation at TUI and timeline boundaries
• move tool implementations from pkg/tools/** to top-level tools/** and document the minimum four-method extension path without adding a plugin framework

Subagent sync/async/fork and scanner verifier/sniper lifecycle migration remain intentionally deferred so they can move together rather than adopt a partial lifecycle abstraction.

Commit structure

Each finding is isolated in a reviewable commit:

1. remove unused Run replay mechanisms
2. narrow chat events to domain events
3. centralize Runtime control state
4. route direct tool execution through AOP
5. remove legacy Agent timeline models
6. promote tools to top-level packages
7. remove TUI and intermediate payloads from Runtime command execution
8. remove obsolete compatibility references

Compatibility notes

These breaks are intentional and documented in #68:

• historical legacy AgentEvent timeline JSONL is no longer accepted
• mixed-version direct-tool peers using CommandPayload.ToolCall/command.result are not supported
• tool imports move from pkg/tools/... to tools/...
• Agent skills use /skill:<name>

Verification

• go test -race ./core/runner ./pkg/webagent ./pkg/agent ./pkg/commands ./pkg/aop -count=1
• all Go packages outside pkg/web
• go test ./pkg/web -skip E2E -count=1
• go test ./core/runner ./core/output ./pkg/tui ./pkg/webagent ./pkg/webproto ./pkg/web -skip E2E -count=1
• go test ./tools/... -run '^$'
• frontend npm run build
• git diff --check

A full go test ./... still hangs in the pre-existing pkg/web terminal E2E test; the package passes when that E2E test is skipped.

Refs #68