fix(adversary): bound agent result reads

[ematipico]

Summary

• replace 50-minute adversary agent reads with deterministic five-minute observation windows
• reattach to the durable Flue submission without cancelling the underlying agent
• log agent, turn, submission, and observation lifecycle state with filterable agent context
• add regression coverage for settlement, reattachment, failure propagation, and lifecycle logging

Agent logs are emitted through the factory Worker observability stream rather than the sandbox container log stream.

Validation

• pnpm test (246 tests)
• pnpm check:types
• pnpm exec biome check src/app.ts src/adversary/agent-read.ts src/adversary/workflow.ts src/flue-logging.ts tests/adversary-agent-read.test.ts tests/flue-logging.test.ts
• pnpm build