fix onboarding runtime validation and first-start routing

[vansin]

What changed

• declare and enforce the Bun prerequisite before Hub startup
• make the first agent-node launch use the existing npx @sleep2agi/agent-node@preview fallback
• reject blank provider credentials only for SDK execution nodes that actually require them
• preserve keyless host_supervisor daemon startup
• reject unknown explicit and persisted runtimes instead of silently falling back
• preserve the legacy agent-sdk + Codex profile as codex-sdk
• route codex-app-server through agent-node, never the Claude launcher, while labeling it preview / production locked
• apply strict runtime parsing to both __custom__ batch inputs

Why

A clean-container onboarding audit found four user-facing failure modes: a hidden Bun prerequisite, an advertised-but-missing first-start runtime path, nodes that appeared online without usable provider credentials, and unsupported runtimes silently launching a different executable. The first correction also overreached by blocking keyless supervisor daemons and missed legacy/batch/CAS branches; this round closes those regressions.

Independent validation

• fresh detached checkout at 91e0b85
• Node 22.22.2, Bun 1.3.14
• targeted onboarding tests: 54 pass / 0 fail / 120 expect
• full bun test src: 146 pass / 0 fail / 283 expect
• npm run typecheck: pass
• npm run build: pass
• git diff --check: clean

Detailed evidence: docs/tests/report-onboarding-fixes.txt.

Scope and remaining release work

This is a Draft PR and a scoped onboarding corrective pass, not a release approval. Before stable promotion:

• align the README/default administrator bootstrap path
• replace or explicitly govern the moving @preview tag; it is not a version pin
• keep RFC-030 Policy Gateway, §8 review, production, deployment, and latest-tag gates locked

No merge, deployment, npm publication, or tag change is authorized by this PR.