fix(runtime): guard paused agent resume transitions

[nguyenlnp]

Fixes #3926

Summary

• add paused/resuming runtime states with guarded state-version transitions
• reject stale, duplicate, or invalid resume attempts before emitting SIGCONT
• record resume rejection/state-transition metrics for auditability
• add deterministic regression coverage for idempotent resume behavior

Tests

• python3 -m pytest tests/test_runtime.py -q
• python3 -m py_compile src/agent/runtime.py tests/test_runtime.py
• git diff --check

/claim #3926