fix: converge runtime authority boundaries

[spytensor]

Summary

• derive delegated permissions from runtime lane and parent context instead of model arguments
• make session permission creation atomic, default non-UI sessions to L1, and remove the create-then-patch UI race
• remove the misleading native shell allowlist, label native checks as best-effort guardrails, and propagate TEL cancellation into foreground shell processes
• make DAG creation transactional, remove dead cycle/topology code, and bound all remaining outbound HTTP calls
• delete the obsolete architecture-gaps document and correct test/documentation claims

Verification

• targeted Vitest files for permissions, delegation, sessions, DAG, TEL, shell, embeddings, config, API routes, prompt contract
• UI useSession test
• pnpm typecheck
• pnpm build:all
• pnpm verify:public-export

No real model/provider workflow or installed App run was performed, per scope.

Closes #31
Closes #32
Closes #33
Closes #34
Closes #35
Closes #36
Closes #37