feat(agent-control): start collection and replay ordered runs

[1012839419a-alt]

Parent contract: #140
Program: #130
Depends on: #142 acceptance gate
Reference Source: #141

Dependency

Start only after slice A (#142) passes. Reuse #141 through the generic registry without editing its provider paths.

Owned paths

• backend/agent_control/handlers/collection.py
• backend/agent_control/handlers/runs.py
• tests/unit/test_agent_control_collection.py
• tests/integration/test_agent_control_run_events.py

Required behavior

Implement collection.start, run.get, and records.query through the authoritative router. Enforce exact Project scope, Connection Binding, short-lived Execution Grant, canonical request hash and idempotency. collection.start returns a durable queued Run ref, not collection success. run.get replays strictly ordered events with explicit retained-history gaps. records.query is bounded, cursor-stable, redacted, and retains Observation/Manifest refs.

Acceptance gate

Denied or expired Grants, scope mismatch, stale readiness and conflicting idempotency keys fail before dispatch. Ordered replay never silently reorders or fabricates events. Targeted tests pass, and a live AIHOT Run produces project-scoped records with one verifiable lineage chain before slice C starts.