Add task-level model and agent selection to workflows

[paullizer]

Summary

• add per-task inherit, model, and agent runners while retaining the workflow-level Default Runner
• normalize authorized non-secret runner summaries on save and revalidate agents, models, and current group role before each task attempt
• dispatch temporary task bindings through the existing sequential workflow path and record per-task runner audit metadata, output previews, and token usage
• extend the shared personal/group stepped builder with conditional runner controls, task-row and Review summaries, safe text rendering, and responsive coverage

Compatibility

• workflows without tasks retain the legacy single-dispatch path
• tasks without runner behave as inherit
• document input remains task-one-only; File Sync, URL access, retries, stop/continue, cancellation, citations, artifacts, alerts, and aggregate token usage keep their existing paths
• no new route, Cosmos migration, or container is introduced

Validation

• 23 passed across focused generic automation, model core capabilities, task sequence, stepped builder, File Sync, and URL access tests
• Python py_compile and node --check passed for changed executable files
• editor diagnostics are clean for changed Python, JavaScript, HTML, and test files
• git diff --check passed
• revision-scoped XSS guardrail passed for 6 changed implementation files
• revision-scoped broken-access-control guardrail passed for 3 changed Python files
• focused Azure Playwright task-runner scenario is included; local execution skipped because no authenticated SIMPLECHAT_UI_BASE_URL / storage state was available
• the existing cancellation contract suite has one unrelated stale v0.250.062 assertion already present on Development

Fixes #1084
Refs #1082