feat(desktop): show saved Run on settings when editing an agent

[tlongwell-block]

What

When editing an agent, show where it runs. The edit dialog previously showed nothing about the backend; the "Where to run" section only existed in the create flow. This adds a read-only Run on section to AgentInstanceEditDialog:

• Local agents: "This computer".
• Provider agents (e.g. Kubernetes): the provider id plus its saved config rows — context, namespace, image, resources, etc. — with labels humanized from the stored keys and rows in provider-schema order (locators first, request/limit pairs adjacent, alphabetical spillover for unknown providers).
• Copy states these are the settings saved at creation and that the run location can't be changed afterwards (a new agent is required).

Design decisions (from thread review with @wren + @sami)

• No provider probe on edit. info is executable work, and its schema reflects the plugin today (including a freshly generated random namespace default) — not what this agent was deployed with. The stored record is the only honest source.
• Saved settings, not effective settings. Optional fields a record omits (e.g. service_account) are defaulted by the provider at deploy time; we render only what was persisted and never synthesize today's defaults.
• Safe rendering of opaque provider config. Values render as safe scalars only; arrays/objects degrade to a summary row (React throws on object children — a hand-edited record must not crash the dialog). Falsy-but-present values (0, false) render honestly. Secret-shaped keys are redacted using the same word-split heuristic as the create-time validate_provider_config gate — one definition of "looks like a secret". The gate already blocks such keys on every app write path; display-side redaction is screenshot hygiene and covers hand-edited records.
• backendAgentId intentionally excluded: deploy-time runtime state written on start, not saved creation intent.
• Read-only, no form state. The backend is immutable post-create (UpdateManagedAgentRequest has no backend field), so the section renders straight from agent.backend with no reset effect.
• ADVANCED_FIELDS_MOTION_TRANSITION was duplicated in both agent dialogs; hoisted to agentConfigOptions (also keeps the edit dialog inside the file-size ratchet).

Testing

• Unit contract for summarizeRunOn (9 tests): scalar honesty incl. 0/false, structured-value fallback, secret redaction fail-safe, preferred ordering with spillover, key humanization.
• Playwright spec (4 tests, registered in the smoke project): kubernetes agent with the exact eight-key record a real create flow persisted, local agent, blox agent (workstation_name), and redacted secret-shaped keys from a hypothetical future provider.
• pnpm typecheck, pnpm check, full pnpm test (3937 pass) green at this head.
• Live screenshots posted in the originating Buzz thread.

[tlongwell-block]

Kubernetes

Saved Kubernetes settings from a persisted agent record, including readable resource ordering and wrapped image digest.

Local

Local agents identify the current computer without provider config rows.

Blox

Provider-generic settings are humanized from the saved config.

Secret-shaped values

Secret-shaped fields are redacted before display.