Add generic runtime package run contract

[chubes4]

Summary

• Add a contract-only agents/run-runtime-package dispatcher for portable agent package workflow execution.
• Add request/result value objects with normalized status, result, evidence refs, metadata, and replay envelopes.
• Keep concrete package materialization, sandbox/runtime provisioning, polling, artifact upload, and provider mapping in consumer runtimes.

Boundary decision

Agents API is the correct first upstream owner for the generic contract because it already owns core-safe agent package/workflow/runtime vocabulary and must stay free of concrete runtime execution. WP Codebox should implement the handler for sandbox/materialization. Homeboy Extensions should map workflow/provider config to this canonical ability once a handler exists.

Verification

• php tests/runtime-package-run-contract-smoke.php
• php tests/runtime-agent-bundle-importer-smoke.php
• php tests/workflow-runner-smoke.php
• php tests/no-product-imports-smoke.php
• composer test

composer phpstan was attempted but could not run because phpstan is not installed in this worktree (sh: phpstan: command not found).

Downstream adoption

• WP Codebox: register wp_agent_runtime_package_run_handler and translate package + workflow into its runtime materialization/execution path, returning the normalized result envelope.
• Homeboy Extensions: point generic runtime profiles at agents/run-runtime-package instead of product-specific ability names and preserve evidence refs from the returned envelope.
• WPSG: replace datamachine/run-agent-bundle runtime tasks with agents/run-runtime-package inputs (package.source, workflow.id or workflow.spec, input, options, metadata, replay).

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Inspected upstream/downstream boundaries, drafted the contract implementation and smoke tests, ran verification, and prepared the PR notes for Chris to review.