[codex] Add PAGS browser runner runtime

[serge-ivo]

Summary

Adds the PAGS-first browser runtime foundation and publishes all current local platform changes in this branch.

This includes:

• a generic local Playwright browser runner package with persistent profile storage, bearer-token protection, task state, events, approval gates, optional PAGS instance binding, request validation, and isolated JSON store state
• pags runner CLI commands for starting the runner, checking local status, creating local tasks, cancelling/approving local tasks, registering a runner with PAGS, probing registered runtime status, creating/approving/cancelling PAGS-proxied tasks, and reading PAGS-proxied task events
• CLI robustness fixes for async command errors, trimmed env/CLI values, encoded API path segments, concise connection failure output, and command-level tests for local cancel plus PAGS approve-task routing
• instance-scoped runtime registration in the API with endpoint validation, encrypted runner-token storage when a KEK is configured, runtime status probing, task proxying, task approval/cancel proxying, event proxying, non-JSON runner response handling, and IPv6 localhost support
• MCP runtime tools for registering/unregistering runners, checking status, running tasks, approving/cancelling tasks, and reading task events
• PAGS-first runtime architecture documentation and browser-runtime store documentation
• the current job application assistant agent scaffold and related console/auth updates that were present in the working tree and requested to be included

Architecture Notes

PAGS remains the control plane and brain/orchestration layer. Local or managed runners are capability executors. PAGS stamps proxied runner calls with X-PAGS-Instance-Id and normalizes runner task payloads before proxying, including forcing approval for browser.open.

The current runner auth is still MVP-grade: bearer token plus optional instance binding. Production hardening should move toward signed per-task requests or short-lived task tokens.

Validation

• pnpm test passed: 306 tests
• pnpm typecheck passed
• pnpm lint passed
• pnpm build passed
• pnpm --filter @proagentstore/cli dev runner --help passed
• CLI connection failure smoke passed with concise error output
• live local runner smoke opened https://gotjob.online/ after approval and returned title GotJob - Find Your Next Great Job
• staged secret-pattern scan found only false positives from task-events before the first push