feat(runtime)!: remove multi-tenant runtime; keep single-env + contracts

BREAKING CHANGE: the multi-tenant ObjectOS runtime moves out of the
open-source framework to the cloud distribution (@objectstack/objectos-runtime).

The framework now supports only the SINGLE-environment local runtime. Removed
from @objectstack/runtime: createObjectOSStack, KernelManager (impl),
ArtifactApiClient, FileArtifactApiClient, ArtifactEnvironmentRegistry,
ArtifactKernelFactory, AuthProxyPlugin, the capability loader, the
per-environment owner/org seeds, and platform-SSO.

Kept (the local `os serve` console needs them): RuntimeConfigPlugin (now
plan-agnostic again), MarketplaceProxyPlugin, MarketplaceInstallLocalPlugin,
resolveCloudUrl/DEFAULT_CLOUD_URL. Also kept as pure interface contracts so a
host runtime can accept an externally-supplied multi-tenant kernel router:
EnvironmentDriverRegistry and a minimal KernelManager (getOrCreate) — the
http-dispatcher's optional `kernelManager` seam now types against these.

Why: cloud business / multi-tenant routing must not live in the open-source
framework, and evolving cloud policy must never require a framework change
(see the reverted #1598). The cloud side already consumes the relocated code
from @objectstack/objectos-runtime; apps/objectos + apps/cloud no longer import
any multi-tenant symbol from @objectstack/runtime.

runtime build (ESM+CJS+DTS) green; 138 runtime tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang