fix(runtime): bind tokens to exact agent placement

[KIDA-MNESIA]

Why

Runtime JWTs were revalidated against the Agent's current workspace and active participant row, but not its exact Computer assignment. A removed host could therefore keep using an already minted token after same-workspace reassignment or Computer revocation. Binding only the Computer id would still allow a move-away/move-back replay.

What

• Add schema migration 0004 with a database-owned opaque runtime_assignment_id that rotates whenever workspace, Computer, participant kind, or departure state changes.
• Bind runtime JWTs to computerId and assignmentId, reject legacy tokens without placement claims, and compare the complete identity with live participant/Computer rows on every request and wake-stream delivery.
• Stop signing tokens for revoked Computers and keep managed-pod placement stable through token mint and Kubernetes apply.
• Let current BYOA daemons discard an authorization-rejected cached token and fetch a fresh device-authenticated token.
• Cover same-workspace moves, move-away/move-back replay, Computer revocation, legacy-token rejection, production minting, and migration integrity.
• Record the trust boundary and rejected alternatives in ADR 0006.

Verification

• npm run lint
• npm run typecheck
• npm run server:typecheck
• npm run build
• npm run guard:big-brain
• npm run guard:llm-tracked
• npm run guard:engine-registry
• npm test (1118 passed, 4 skipped, 0 failed)
• npm run test:integration against pgvector/pgvector:pg16 and Redis (297 passed, 5 skipped, 0 failed)