per-agent instruction rules wired into prompt assembly

[vmelikyan]

• Fixed "Instruction rules" being a silent no-op: additiveRules (and systemPromptOverride) were written to runtime config but never read by any runtime path — replaced with agent_instruction_rules, actually injected into the system prompt (scoped per agent or all agents, global or per repository, frozen into the run-plan snapshot)
• Added GET/PUT /api/v2/ai/admin/agent/instruction-rules and GET /api/v2/ai/admin/agent/prompt-preview (returns the exact assembled system prompt with per-part sources, sharing the executor's assembly helpers)
• Removed the dead config fields end to end (types, schemas, validator, PATCH handlers, OpenAPI); migration also strips stale keys from stored config blobs
• Rewrote the Debug agent instructions (template v10 → v11): dropped a wasteful query_database fallback, added routes for unreachable publicUrl, control-plane stalls, deploy-phase pipeline logs, and stale/transient failures, stated update_file's full-file + diff-guard semantics, clarified the one-mutation budget (hypothesis patches count), and merged redundant sections
• Fixed Debug runs ignoring composer MCP selections: a blanket resourceDomain === 'mcp' strip deactivated every MCP tool despite the whole selection chain being wired; intent gating now scopes MCP tools by read/write effect (test fixtures now carry resourceDomain so the suite exercises the production shape)