feat: validate deployment runtime registration

[shaypal5]

Summary

• Adds provider-neutral runtime registration metadata to signup profiles.
• Adds deployment-configurable runtime, handle-kind, project, and binding policies.
• Persists safe runtime labels only; raw session identifiers and provider configuration paths are outside the core contract.
• Adds CLI file inputs for private enrollment wrappers and operator profile display support.

Safety and compatibility

• Runtime registration is immutable after signup.
• Existing deployments opt in through environment bindings; no private deployment policy or path is included here.
• The worker receives only validated safe metadata and opaque delivery references.

Verification

• npm run check
• npm test (64 passing)
• npm run build

Follow-up

A separate private deployment PR supplies its handle grammar, runtime mapping, and local enrollment wrapper after this generic capability merges.

[shaypal5]

Author adversarial self-review

I reviewed this as a skeptical senior maintainer. Issues found and fixed before this review:

1. Runtime metadata could have been changed through profile updates after signup. Fix: runtime registration is now immutable via the profile-update endpoint, and existing safe values are preserved during ordinary profile edits.
2. A syntactically valid handle kind absent from the deployment mapping would have reported a server-policy error. Fix: it is now a clear client rejection, while malformed policy remains a server configuration error.
3. --profile-file unnecessarily blocked the optional direct onboarding-auth value. Fix: file-based profile input now accepts that optional positional auth value or the private auth-file option.
4. The API documentation had two profile objects in one JSON example. Fix: the runtime object is now part of the single complete profile object.

Recommended action for each issue was implemented and covered by the relevant validation/test path. No remaining blocking issue found in the final diff.