Remove agent principals and move automation to scoped credentials

[jgpruitt]

Goal

Simplify Memory Engine’s authorization model by removing agent principals and their impersonation-based execution model.
Automation now runs as the credential it presents:

• Developers and local AI-tool integrations use their user session or PAT.
• Restricted single-user automation uses a scoped PAT.
• CI and shared integrations use service-account keys.

This removes me agent, agent API keys, agent homes, --as-agent, ME_AS_AGENT, X-Me-As-Agent, ambient harness impersonation, and agent-by-config behavior. Legacy agent: config is accepted and preserved but has no effect; legacy X-Me-As-Agent is ignored.

Changes

• Remove agent schema/auth/protocol/client/server/CLI surfaces.
• Add upgrade migration 018_remove_agents.sql to delete retired agent principals and dependent state while preserving existing memory rows at their current paths.
• Preserve users, groups, service accounts, scoped PATs, and direct credential-based MCP/capture/import flows.
• Simplify harness injection to inert AI_AGENT metadata plus ME_PROJECT_DIR project discovery.
• Replace retired-agent tests with PAT, service-account, migration-retention, and legacy-compatibility coverage.
• Remove obsolete public agent-principal documentation and add TNT-244_RELEASE.md for the coordinated 0.7.0 release.