Fix Claude native agent resolution and fail-closed skill admission

[Trecek]

Claude skill projections could ask for unregistered agent types such as delegated-worker, while session admission skipped native-target reachability. This change maps that role to general-purpose, maps bundled roles to autoskillit:<name>, and keys rendered instructions and model policies by the resolved native name.

Runtime-selected bundled agents now have a typed binding, preserving Claude eval-agent admission while Codex refuses unsupported runtime provisioning. Claude returns its resolvable agent universe so unresolved static targets fail closed. Logical roles use one bare-name grammar, with deterministic migration for existing prefixed declarations. Agent publication excludes guide files through a shared definition-file predicate.

The change includes independent rendered-target and publication checks, projection-version invalidation, and isolated hook/launch fixtures. Small module moves keep the implementation within the repository's existing source limits.

Validation:

• Part A configured local gate: 50,653 passed.
• Final Part B configured local gate: 50,722 passed, 616 skipped, 29 xfailed.
• pre-commit run --all-files passed.
• Claude projection smoke check confirmed resolvable targets, matching agent inventory, and absent guide files; native plugin manifest validation passed.

Closes #5238.