Transport native task results through a result file

[chubes4]

Summary

• add an atomic agent-task-run --result-file transport with private file permissions
• make the reusable executor read and validate a controlled result file rather than bounded stdout
• fail closed for invalid paths, files, sizes, schemas, statuses, and configured secrets

Fixes #1763
Regression: https://github.com/Automattic/wp-codebox/actions/runs/29296787203

Testing

1. npm run build
2. npm run test:agent-task-contracts
3. npm run test:redaction
4. npm run test:production-boundary-enforcement
5. npm run test:runtime-tool-policy
6. npx tsx tests/cli-main-output-drain.test.ts
7. actionlint .github/workflows/run-agent-task.yml

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Terra and OpenCode
• Used for: Implemented the result-file transport, tests, documentation, and verification with Chris's requested scope.