fix(bridge): prove portable live execution

[drewstone]

What changed

• write portable live AgentProfiles with separate runner, provider, and model fields
• find a sibling CLI Bridge checkout and apply Pi's Linux isolation default when launching locally
• make package-manager subprocesses portable across Linux, macOS, and Windows
• test effective per-run capabilities without launching an uncancellable second generation
• run the deterministic live-bridge matrix in repository CI

Proof

• pnpm check: 463 tests, 461 passed, 0 failed, 2 protected live skips
• real packed GLM 5.2 flow: exact marker, 17,553 input tokens, 14 output tokens, reported cost $0
• packed process exited naturally with code 0; CLI Bridge stopped; all three temporary directories removed
• evidence: /home/drew/code/.release-artifacts/braid-live-a4701b3-glm-final/live/bridge/evidence.json

Luna reached the corrected profile and secure Pi launch path, then stopped before inference because the local Pi catalog advertises an openai-codex model that has no explicit provider entry; that CLI Bridge defect is being tracked upstream.