feat(agent-interface): add minimal AgentInstance contracts

[drewstone]

Why

An execution environment is a computer, not an AgentProfile appliance. It may host zero, one, or many managed agents without making a profile part of machine identity.

What

• add a deliberately small provider-neutral AgentInstanceSpec
• add shared/isolated workspace intent
• add public lifecycle, sanitized failure, and idempotent stop contracts
• add strict Zod validators
• export from the package root and @tangle-network/agent-interface/agent-instance
• document the provider ownership boundary

Deliberately not included

Provider credentials, named-profile registries, placement, billing, process ids, workspace roots, local resource scheduling, grants, metadata bags, and fencing remain provider-private. The public lifecycle record does not echo the full profile or provider request.

Compatibility

Additive only. Existing AgentProfile, runtime, cancellation, and activation contracts are unchanged.

Validation

• pnpm --filter @tangle-network/agent-interface check-types
• pnpm --filter @tangle-network/agent-interface test
• pnpm --filter @tangle-network/agent-interface build
• pnpm check:package-artifacts
• git diff --check

Merge criteria

• profile-less agents remain valid
• a profile never implies a VM
• unknown/provider-specific fields fail strict validation
• failed records require sanitized failure evidence
• no credential/process/placement state enters the portable record
• package root and subpath artifacts remain valid