feat(runtime): scope live validation by supervised node

[drewstone]

Recursive provider managers share the same backend, so a live validator could not distinguish the root product contract from a nested director or worker contract. Pass an immutable execution-node snapshot into ValidationCtx.node, including Runtime-owned depth (0 for the root), while the environment is still available.

Populate depth for scope owners and spawned executors without changing recovery records. Standalone calls may omit node context. Add recursive HTTP-MCP coverage proving root → director → leaf depths, root-only file checks, distinct node/attempt identities, and validation before teardown. Prepare Runtime 0.230.0 with generated API documentation and fixtures.

Validation:

• All four GitHub checks pass: CI, packed-cohort, agent-bench, and official-optimizers.
• Combined with fix(coordination): preflight public endpoints before provider admission #1251, the full local suite passes: 4,011 passed and 11 skipped across 309 files (--maxWorkers=2, 634.88 seconds; tree 69719261adae9a489374ea021704066e170b80be).
• Source/example typechecks, lint, API/version checks, documentation freshness, and packed-package verification pass.
• Independent code review found no issues. The configured Codex reviewer could not run because review credits are exhausted; required GitHub approval remains pending.

The first unrestricted local suite ran beside another full suite and hit three timing limits. All 52 tests in those three suites passed with bounded concurrency before the complete combined run passed. No production behavior was changed to accommodate those failures.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[drewstone]

Cloud reliability owner: user explicitly requested resolving and merging the outstanding Runtime PRs. I am taking conflict integration of this existing PR, preserving its validation-node contract and current main continuity/auth/tracing. #1251 is being integrated separately by my lane; I will not touch your original worktree or force-push. Please flag an active competing merge or source change. Final release keeps the newest behavior and coherent version metadata.

[drewstone]

Conflict integration pushed as b52095f, preserving current main690c5158 and public preflight7b2df3aa. Runtime0.231.1/Bench0.13.2/Sandbox0.40.2/Knowledge17.0.2 remain coherent. Local combined proof passed180 tests across provider-validator-context, provider-executor-composition, retained owner recovery, coordination HTTP, and environment provider; source/examples typecheck, build, API record, lint, docs freshness, version check passed. Generated documentation then regenerated and normal hooks passed. During review I removed an accidental restoration of the old abort listener so #1255 cleanup remains. Logs: /tmp/runtime-cloud-owner-0435-combined-*.log. Existing PR only; no source changes to prior owner worktree. Final cloud/release proof remains pending.