fix onboarding runtime validation and first-start routing

[vansin]

What changed

• declare and enforce the Bun prerequisite before Hub startup
• make the first agent-node launch use the existing npx @sleep2agi/agent-node@preview fallback
• reject blank provider credentials only for SDK execution nodes that actually require them
• preserve keyless host_supervisor daemon startup
• reject unknown explicit and persisted runtimes instead of silently falling back
• preserve the legacy agent-sdk + Codex profile as codex-sdk
• route codex-app-server through agent-node, never the Claude launcher, while labeling it preview / production locked
• apply strict runtime parsing to both __custom__ batch inputs

Why

A clean-container onboarding audit found four user-facing failure modes: a hidden Bun prerequisite, an advertised-but-missing first-start runtime path, nodes that appeared online without usable provider credentials, and unsupported runtimes silently launching a different executable. The first correction also overreached by blocking keyless supervisor daemons and missed legacy/batch/CAS branches; this round closes those regressions.

Independent validation

• fresh detached checkout at 91e0b85
• Node 22.22.2, Bun 1.3.14
• targeted onboarding tests: 54 pass / 0 fail / 120 expect
• full bun test src: 146 pass / 0 fail / 283 expect
• npm run typecheck: pass
• npm run build: pass
• git diff --check: clean

Detailed evidence: docs/tests/report-onboarding-fixes.txt.

Scope and remaining release work

This is a Draft PR and a scoped onboarding corrective pass, not a release approval. Before stable promotion:

• align the README/default administrator bootstrap path
• replace or explicitly govern the moving @preview tag; it is not a version pin
• keep RFC-030 Policy Gateway, §8 review, production, deployment, and latest-tag gates locked

No merge, deployment, npm publication, or tag change is authorized by this PR.

[vansin]

分诊（2026-07-29，通信龙）：建议保留并 rebase，优先级高。

本 PR 与今天的两个 P0 高度重叠，而且部分工作今天被独立重做了一遍：

• 「declare and enforce the Bun prerequisite before Hub startup」—— 今天的新人视角走查发现，照 README 复制代码块跑会崩 spawn bunx ENOENT。我只改了文档位置（docs: Bun 前置提到快速上手代码块之前（新人第一步就崩） #484 已合），本 PR 是在代码里强制检查，比我做得彻底。
• 「reject unknown explicit and persisted runtimes instead of silently falling back」—— 这正是 issue [latest] agent-node 对 --runtime 不做校验：任意字符串（含 bogus-xyz）均被接受并静默退化 #478 的内容（当前填一个不存在的 runtime 也照收）。

当前状态：CONFLICTING / DIRTY，需 rebase 到 origin/main。冲突大概率来自今天合入的 #484（README）与 #483 / #489（cli.ts）。

这条是「陈旧 PR 腐烂」的活样本：它躺了两周没人合，期间我们从零重新发现并修复了它已经修过的问题。每多躺一天，冲突只会更多，而重复劳动已经发生过一次。

建议：确认 owner → rebase → 走正常复核。若判断已被今天的改动完全覆盖而无需保留，也请明确关闭并说明理由，不要继续挂着腐烂。