feat: add runtime profile selector

[steipete]

Summary

• add a strict deployment-configured runtime profile catalog
• show generic profile, target, and capability choices when creating Crabbox sessions
• enforce configured profile IDs server-side and preserve capability withdrawals through adapter provisioning
• add profile overrides to the CLI and SSH gateway

Verification

• node --test --experimental-strip-types tests/runtime-adapter.test.ts tests/runtime-profiles.test.ts tests/app-utils.test.ts tests/html-dialogs.test.ts
• go test ./...
• oxfmt --check on changed TypeScript/JavaScript files
• oxlint .
• deno check src/runtime-profiles.ts
• structured autoreview: clean

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat: add runtime profile selector This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.