feat(runtime): pluggable agent runtimes (cc / codex)

[yaozheng-fang]

Add a pluggable runtime layer so an agent's inner reasoning/tool loop can be driven by an external agent harness, while the ADK Runner keeps owning multi-tenancy, session, memory and tracing.

What

• Agent(runtime=...) selector: "adk" (default, unchanged) | "cc" | "codex".
• veadk/agent.py: minimal _run_async_impl dispatch hook (defers to ADK for adk, else to veadk.runtime.get_runtime).
• veadk/runtime/base_runtime.py: BaseRuntime ABC + build_system_append (appends agent name/description/instruction to the harness system prompt — append, not replace).
• veadk/runtime/__init__.py: get_runtime registry with friendly errors when optional deps are missing.
• cc (Claude Code SDK): translate session<->events, isolate from ~/.claude (setting_sources=[]), pin the configured model across all tiers.
• codex (OpenAI Codex SDK): isolated CODEX_HOME config, Responses<->chat bridge via an in-process litellm shim (Codex only speaks the Responses API).

Design notes

• Sessions: ADK session is the single source of truth; runtimes use stateless replay (rebuild the transcript each turn). No persistent SDK-side session mapping.
• cc is restricted to Anthropic-compatible endpoints (commit 2): routing Claude Code to a non-Anthropic model via the shim is disabled pending license/terms review. The shim code remains for easy re-enable.

Scope

• Touches only veadk/agent.py + veadk/runtime/** (no examples/docs in this PR).
• Optional deps are lazy-imported: cc needs claude-agent-sdk fastapi uvicorn; codex needs the Codex binary + codex_app_server + fastapi uvicorn.
• Not yet covered: exposing veadk tools via in-process MCP, SDK-side session resume mapping. codex was not E2E-tested locally (no Codex binary); the litellm Responses bridge was verified.

🤖 Generated with Claude Code