fix(ralph): enforce configured agents

[almogdepaz]

summary

• derive Ralph-capable agents from enabled configured commands
• populate the Ralph picker from the machine settings instead of hardcoded options
• reject direct start requests for unconfigured or disabled agents before lock/spawn
• default only to the first configured Ralph-capable agent

verification

• focused Ralph/API tests (200 passed)
• focused browser navigation suite (5 passed; 10 project-gated skips)
• bun run typecheck
• bun test (1,649 passed)

Closes #162

[almogdepaz]

Superseded by #179, which contains this PR’s commit plus the consolidated dev07 hardening and terminal-recovery work. Closing so review stays centralized.