Propagate runner workspaces into agent tasks

[chubes4]

Summary

• move the runner workspace seed into canonical task_input.workspaces, which the CLI unwraps before recipe construction
• retain sanitized runtime results and staged artifact references when apply, verification, no-op, or publication gates fail
• cover the hosted workspace shape and regressions from run 29324157852 and run 29324563665

Fixes #1786

How to test

1. Run npm run build.
2. Run npm run test:native-agent-task-lifecycle.
3. Run npm run test:agent-task-contracts.
4. Run npm run test:runtime-sources-playground-integration.
5. Run actionlint .github/workflows/run-agent-task.yml.

The Playground integration intercepts three local OpenAI turns, has the imported agent read and edit a seeded README, and verifies the canonical patch capture.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI gpt-5.6-terra via OpenCode
• Used for: Traced the request-to-recipe handoff, implemented the workspace propagation and failure-envelope handling, and added regression coverage.