feat: add runtime reconciliation API

[rogerchappel]

Summary

• add a read-only reconciliation preview for a selected runtime
• classify current, safely detached, ambiguous unbound, and other-runtime agents
• add an explicit apply action that removes selected workspace grants and archives affected DMs
• preserve all agent rows, channel rows, chat sessions, and messages

Safety model

• agents active on the selected runtime are never eligible
• detached agents with retained runtime identity are suggested
• ambiguous manual/unbound agents require explicit user selection
• runtime ownership is enforced for personal owners and company administrators
• apply uses one short transaction and does not call an external runtime

Provider support

The API uses CrewCMD runtime and agent bindings only. It is provider-neutral for OpenClaw, Hermes, and future runtimes.

Verification

• focused reconciliation API tests — 4 passed
• pnpm test — 567 passed
• pnpm typecheck — passed
• focused ESLint — passed
• pnpm build — passed with existing Next.js workspace/NFT warnings
• git diff --check — passed

Risk and rollback

Risk is medium because apply changes workspace visibility and archives DMs. It never deletes agent or message history. Roll back by reverting the single commit; archived channels can be restored by clearing archived_at, and agents can be re-granted to the workspace.