Execute imported runtime package agent

[chubes4]

Summary

• bind runtime-package chat execution to the single agent identity verified from imported package bytes
• reject caller-supplied package, metadata, or chat agent identity mismatches and preserve the generic sandbox only when no package is imported
• cover technical-bootstrap and skills package shapes plus the generated Playground runtime-package provider execution

Closes #1781
Regression source: https://github.com/Automattic/build-with-wordpress/actions/runs/29311239264

Testing

1. npm run build
2. npm run test:runtime-package-execution
3. npm run test:agent-task-contracts
4. npm run test:agent-no-data-machine-loop
5. npm run test:runtime-sources-playground-integration
6. npm run test:production-boundary-enforcement
7. npm audit --omit=dev --audit-level=high
8. actionlint .github/workflows/*.yml

AI assistance

• AI assistance: Yes
• Tool(s): openai/gpt-5.6-terra and OpenCode
• Used for: Traced the generated Playground runtime-package import path, added intercepted provider and spoof regression coverage, and ran verification.