Add repository agent profiles

[johnnygreco]

Summary

• add a reusable dev-tools/agents framework for repository-owned OpenShell agent profiles
• organize runtime concerns under runner/ with a focused standalone profile_resolver.py
• add schema-enforced task responses, profile guidance resolution, and a pinned Pi print-mode harness
• configure inference through INFERENCE_BASE_URL, INFERENCE_API_KEY, and MODEL_ID_TOP
• add path-scoped CI covering validation, unit tests, lint/format checks, shell syntax, sandbox staging/build, and ephemeral mTLS gateway authentication

Why

The agent runtime should be established and reviewed independently before downstream workflows consume it. The streamlined structure keeps profile-owned prompts and policy separate from runner-owned OpenShell lifecycle code.

Validation

• uv lock --script profile_resolver.py --check
• python3 -m unittest discover -s tests -v (8 tests)
• Ruff lint and formatting checks
• Python compile checks
• Bash syntax checks
• git diff --check

The local Docker build reached the pinned Docker Hub image lookup but the current environment's Docker daemon has an invalid proxy configuration. The path-scoped GitHub Actions job performs the complete staged Pi image build.

This replaces #39, which GitHub automatically closed when its head branch was renamed.