[codex] Guard engine config flag emission

[xu16601526267]

What changed

• Added optional startup.accepted_config_keys to engine YAML so narrow wrapper servers can declare exactly which config keys may be emitted as CLI flags.
• Wired the allowlist through resolver, Docker, native, and K3S pod generation paths.
• Marked z-image diffusers engines as accepting only port, preventing LLM-only flags such as --max-model-len from being passed to image servers.
• Tightened synthetic model config generation so scanned non-LLM engines with declared args do not receive vLLM-shaped context defaults.

Why

AIMA can merge LLM-oriented defaults, automatic fit adjustments, or user overrides into a single config map. That is fine for broad engines such as vLLM, but narrow FastAPI/image/audio wrappers can fail at startup when they receive unrelated LLM flags. This change makes the engine catalog the source of truth for which config keys are runtime CLI flags.

Validation

• git diff --check
• go test ./internal/knowledge -run "TestBuildSyntheticImageModelDoesNotInjectLLMContext|TestGeneratePodFiltersUnsupportedConfigFlags|TestBuildSyntheticConfig_NoVRAMLeakForEnginesWithoutDeclaredKnob"
• go test ./internal/runtime -run "TestConfigToFlagsHonorsAcceptedConfigKeys|TestBuildRunArgs_FiltersUnsupportedConfigFlags|TestToResolvedConfigCarriesAcceptedConfigKeys"

Full go test ./internal/knowledge ./internal/runtime ./cmd/aima was also attempted on Windows. internal/knowledge passed; internal/runtime and cmd/aima still hit existing Windows-environment failures around POSIX path expectations, stale PID/port detection, and symlink privileges.