feat: migrate ohAgent sessions to the public Jcode SDK runtime

[akvarel]

Summary

Move ohAgent gateway sessions from private Jcode application internals to the public jcode-sdk runtime boundary.

• launch one tenant-private external Jcode runtime per tenant domain
• require explicit tenant IDs for all session lifecycle operations
• use opaque SHA-256-derived workspace and runtime keys
• create missing workspaces securely and reject unsafe paths
• return SDK assistant text to the gateway and forward image, model, interrupt, cancel, archive, detach, and removal operations
• package matching ohagent-daemon, jcode, and jcode-harness-api-bridge binaries
• use persistent, pod-specific, Unix-socket-safe runtime homes in Docker Compose and Kubernetes
• document architecture, failure behavior, acceptance requirements, and complete requirement-to-check traceability

Dependency

• Jcode fork dependency: fix: provide minimal Jcode SDK runtime fixes for ohAgent jcode#3
• Parent submodule is pinned to 4fe8a3a29

Acceptance evidence

• public SDK runtime boundary: 7/7 passed
• real credentialed DeepSeek turn returned the expected assistant response in 9.86 seconds
• same-tenant access succeeded; cross-tenant lookup, list, and archive were hidden or rejected
• missing workspace was created securely before runtime launch
• gateway dispatch tests passed and preserve SDK assistant text and image forwarding
• worst-case Kubernetes socket path: 104 bytes, below the 108-byte limit
• Docker image ohagent:jcode-sdk-runtime built successfully
• non-root container smoke found all three binaries and a writable persistent runtime root
• docker compose config --quiet passed
• Kubernetes deployment YAML parsed
• retained Jcode MCP reconnect and harness working-directory suites passed
• Graphify regenerated both repositories
• secret and private-internal scans passed

Broad validation limitations

• complete ohAgent-only package run passed 197 unit/integration tests, then reached two unchanged ohagent-provider-metrics doctests whose prose diagrams are incorrectly compiled as Rust
• full parent workspace reached upstream jcode-base: 1300 passed, 9 baseline/environment failures, 1 ignored
• six upstream failures require external sqlite3; three are unchanged lifecycle, harness-path, and sponsor-provenance expectations
• focused Clippy reaches existing warning debt in unchanged provider-metrics code

Full mapping: IMPLEMENTATION-REPORT-JCODE-SDK-RUNTIME.md.
Architecture: docs/JCODE_SDK_RUNTIME_ARCHITECTURE.md.

Safety

• no production deployment or infrastructure mutation
• no secrets changed or committed
• unrelated TEAM_MEMORY/SESSION_LOG.md work was preserved and excluded
• all AI-assisted commits include AI-assisted: Jcode