[codex] Plugin runtime stage 3 providers

[winrey]

Summary

• Adds managed runtime exec capabilities for node and python, advertised as node-exec/python-exec when installed with executable resources.
• Adds a capability provider registry and explicit plugin:node / plugin:python job routing without changing plain node/python PATH behavior.
• Routes cloud and IPC job dispatch through providers, with managed runtime interactive PTY requests rejected explicitly.

Test Plan

• rustfmt --edition 2024 --config skip_children=true --check crates/ahandd/src/ahand_client.rs crates/ahandd/src/executor.rs crates/ahandd/src/ipc.rs crates/ahandd/src/plugin_runtime/activation.rs crates/ahandd/src/plugin_runtime/capability.rs crates/ahandd/src/plugin_runtime/mod.rs crates/ahandd/src/plugin_runtime/provider.rs
• cargo test -p ahandd plugin_runtime
• cargo test -p ahandd executor::tool_resolution_tests
• cargo test -p ahandd ahand_client
• cargo test -p ahandd ipc
• cargo test -p ahandd --test job_request_tool
• cargo test -p ahandd --test hub_handshake
• cargo test -q -p ahandd --test hello_signature
• cargo check -p ahandd -p ahandctl
• cargo build -p ahandd --bin ahandd
• target/debug/ahandd plugin host-resource --json >/tmp/ahand-stage3-host-resource.json
• jq -r "[.platform,.arch,((.plugins|map(.id)|sort)|join(","))] | @TSV" /tmp/ahand-stage3-host-resource.json
• target/debug/ahandd plugin doctor
• git diff --check codex/plugin-runtime-stage2..HEAD

Notes

• On this machine, plugin doctor reports node/python Missing and browser-playwright-cli Blocked because managed runtimes are not installed locally; host-resource still enumerates all five first-party plugins.

[winrey]

Merged manually into dev (bc08c71) and main (f99c4cf). Closing the draft PR because its original base was codex/plugin-runtime-stage2.