T-35: Govern rules, TTSR, and extensions

[jaesbit]

Summary

• expose a Governanza view for rules, hooks, extensions, TTSR history, and configuration audit entries
• persist and surface rule and extension enable/disable changes with validated API endpoints
• carry TTSR injections and extension-load errors across bridge boundaries
• honor OMP_AGENT_DIR when initializing SDK settings

Verification

• bun test in apps/server — 897 pass, 0 fail
• focused governance and SDK tests — 37 pass, 0 fail
• web typecheck and Vite production bundle succeeded
• isolated HTTP smoke test exercised inventories, TTSR history, disable/enable transitions, audit trail, and verified no change to the real agent config