refactor(api-core): hide service runtime assembly

[poroh]

Reduce the public surface and clarify the boundary of carbide-api-core by keeping service runtime assembly private while exposing a narrow bootstrap interface to the carbide-api composition crate.

This is the fourth change in the series:

1. Move logging initialization and the top-level run entry point — refactor(api): move logging initialization into api crate #3851.
2. Move metrics initialization, the metrics endpoint, and process task ownership — refactor(api): move metrics initialization into api crate #3860.
3. Move database, Vault, credentials, certificates, KMS, and secret-import setup — refactor(api): move resource initialization into api crate #3864.
4. Consolidate the remaining service runtime assembly behind the hidden bootstrap interface — this PR.

This PR replaces the thin run boundary adapter with RuntimeInputs and start_runtime in the existing hidden bootstrap module. Dynamic settings and Redfish client setup remain internal to api-core, alongside API construction, controller startup, listener startup, and readiness signaling.

The existing startup behavior and configuration handling are preserved. Dependencies no longer used by api-core are removed, while test-only dependencies move to dev-dependencies.

Related issues

#3851
#3860
#3864

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

This PR is stacked on #3864 and should merge after it.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2a18c862-3b22-447d-974e-2d233d21f71a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}