feat(intelligence): withIntelligence hook — unify send/receive, fix dropped typed diffs

[drewstone]

What

One agent-runtime SDK hook, withIntelligence, that unifies the three fragmented Intelligence send/receive mechanisms and fixes the dropped typed-diff receive.

The Intelligence plane's GET /v1/profiles/:target/composed already returns { agentProfile, agentProfileDiffs, capabilities }, but the old receive path (withCertifiedDelivery / CertifiedProfile / pullCertified) deserialized only promptSurface + artifacts and dropped the typed agentProfileDiffs. This PR deserializes what was already on the wire and surfaces it.

The hook

withIntelligence<I, O>(
  agent: (input: I, applied: AppliedIntelligence) => Promise<O>,
  config: IntelligenceConfig & { target?; refreshMs?; onProposals? },
): ((input: I) => Promise<O>) & { refresh(): Promise<void>; proposals(): ProposedProfileDiff[] }

• SEND — a typed RunRecord { runId, traceId, project, target, input, output, outcome:{success?,score?,usage:{inferenceUsd,intelligenceUsd}}, model?, provider?, loopEvents? } serialized through the existing OTLP builders (flatOtelSpan + buildLoopOtelSpans, no second builder) to /v1/otlp. Best-effort / fail-open.
• RECEIVE — CertifiedProfile + pullCertified extended with agentProfileDiffs: {diff: AgentProfileDiff, provenance:{version,lift,contentHash,promotedAt}}[], capabilities, and agentProfile. The previously-dropped typed diffs now round-trip.
• AppliedIntelligence += proposals, applyProfile(base) (folds via applyAgentProfileDiff from @tangle-network/agent-interface@0.19.0), and record(report) to populate the RunRecord. The prompt-only composePrompt(base) convenience is preserved.
• Safety — observe + deliver only. The hook never auto-applies a received diff at runtime; it surfaces them via proposals() / onProposals, and applyProfile is caller-invoked. This preserves the held-out invariant the plane enforces.

Clean replacement (no consumers — delete, not deprecate)

• Deleted withTangleIntelligence and withCertifiedDelivery (and their prompt-only types). withIntelligence is the one hook. Repo-wide grep shows zero references to the deleted names.
• Collapsed the endpoint env sprawl to one base URL: baseUrl config / TANGLE_INTELLIGENCE_URL env, from which both send (${base}/v1/otlp) and receive (${base}/v1/profiles/:target/composed) derive. Removed INTELLIGENCE_OTLP_ENDPOINT, the OTEL_EXPORTER_OTLP_ENDPOINT dual-read, and INTELLIGENCE_BASE. Send now gates on a tenant apiKey (the ingest requires it).
• Migrated the in-repo examples + docs + the package-export verifier.

Verification

• pnpm build (ESM + DTS), pnpm typecheck, pnpm verify:package, pnpm docs:freshness — all green.
• pnpm test — 1280 passed, 2 skipped (132 files).
• New round-trip test: a composed-endpoint fixture with agentProfileDiffs[] flows through the receive path; proposals() returns them and applied.applyProfile(base) equals applyAgentProfileDiff(base, diff) — the previously-dropped diffs are received.
• New send test: a typed RunRecord ships to /v1/otlp carrying target + the usage split + model.

Deferred

The optional defineAgent.intelligence binding + improve(seedFrom: applied.proposals) is deferred — it ripples into the held-out improvement loop's proposer contract (a separate subsystem), and proposals are already accessible via applied.proposals / wrapped.proposals(), so nothing is blocked.