feat(agent): add actor runtime state

[handsdiff]

Summary

Adds an actor/runtime state layer so an agent can reason across isolated sessions without collapsing identity boundaries.

• records inbound, outbound, directive, and cron-related runtime events in state.db
• resolves per-platform actor identity/authority, including owner turns outside owner DMs
• injects an ephemeral self-state packet into gateway turns
• adds self_state for read-only runtime introspection
• gates public outbound sends against recent owner directives and unsafe cross-session broadcasts

Stack

Depends on:

• feat(model): match-based model routing via model.routes NousResearch/hermes-agent#12234 (feat/model-routing)
• feat(routing): expose user_id for trusted routing contexts NousResearch/hermes-agent#14883 (feat/routing-context-user-id)

Verification

• Focused actor/routing/state regression suite: 319 passed, 1 warning
• Broader gateway/tooling/cron regression suite with optional extras: 527 passed, 4 warnings
• Integration rebuild: same broader suite passed with 527 passed, 4 warnings
• Canary focused regression suite: 307 passed, 4 warnings
• Owner group-source sanity: authority=owner; routing context includes source_kind: owner and owner user_id

[handsdiff]

Closing this fork-local stacked PR now that the upstream PRs are open (NousResearch#14883 and NousResearch#14884) and fork main has been rebuilt with the branch.