fix(agents): fail closed on host resolution

[KIDA-MNESIA]

Summary

• fix CQ-H3 by representing Agent host resolution as explicit found, missing, or error outcomes and never converting database or invalid-assignment failures into cloud placement
• carry host and tier in one tenant snapshot, retry transient pre-placement wake failures, and alert on dangling, cross-tenant, or revoked assignments
• revalidate paid managed placement at ensurePod entry and immediately before Kubernetes writes, with machine-readable failure codes
• document the execution-placement boundary in ADR 0002

Tests

• npm run lint
• npm run typecheck
• npm run server:typecheck
• npm test (1061 passed, 4 platform-gated skips)
• npm run test:integration (277 passed, 5 credential-gated skips)
• npm run guard:big-brain
• npm run guard:llm-tracked
• npm run guard:engine-registry
• npm run build