Define runtime env injection contract

[FatPigeorz]

Summary

• Track Agentix-owned runtime env additions via AGENTIX_ADDED_* and add get_env_without_agentix() for exact-entry subtraction.
• Inject runtime build/toolchain paths (PATH, LD_LIBRARY_PATH, LIBRARY_PATH, include paths, pkg-config, CMake) into the runtime/worker env and record what was added.
• Update Docker deployment bootstrap to mount /nix, inject the same env contract, and exec the venv agentix-server.
• Keep bash.run inheriting the runtime env by default so bundle-provided tools/toolchains work, and expose executable= for bash/zsh/fish/custom shell execution.

Refs #9

Verification

• uv run pytest
• uv run pyright
• uv run ruff check agentix plugins/deployment-docker plugins/runtime-basic tests/test_runtime_env.py tests/test_worker_env.py tests/test_docker_deployment.py