feat(runtime): add automatic credentials

[kinzhi]

Summary

• add durable Runtime Node key generation, automatic credential enrollment, renewal, and TLS rotation
• discover the Runtime origin and credential endpoint from the platform URL
• make token-only discovery skip credential manager creation, CSR issuance, renewal, and client certificates
• pin the configured Node selector on Runtime HTTP and WebSocket requests
• fail closed when policy rediscovery changes the mTLS requirement

Security behavior

Token-only compatibility mode requires configured Node and Agent IDs. The Agent Token is the authentication factor; the Node ID is a server-validated identity selector. It cannot be used for zero-touch enrollment.

Validation

• Python 3.12: pytest — 95 passed, 1 skipped
• ruff check .
• python -m build
• Runtime contract drift check