feat(agents-api): persist scoped Environment executor credentials

[SaladDay]

Environment executors previously depended on a static digest file: provisioning or excluding a key required service restart, and registration replacement alone did not revoke its holder. This change issues one durable, randomly generated executor credential per Environment and lets the existing native registry enforce explicit rotation, revocation and owning Session deletion.

The operator command returns the secret once; PostgreSQL retains only its current digest, issue time and revocation state. Issuance cannot silently replace a credential. Registration, validation, socket attachment and live heartbeats check durable authority. Old requests cannot displace registration under a rotated key, and alternate UUID spellings cannot create another registration for the same Environment. Registry restart preserves credentials while invalidating process-local grants. The old executor-key-file setting fails explicitly with migration instructions; harness key configuration and native grants retain their separate lifetimes.

The independent binaries and container include agents-api-environment-key. No public SDK routes/fields, Environment admission, model/tool loop, product behavior or dependencies change. Heartbeat-driven disconnection is not native process quiescence. Public caller/user/service-account equivalence and third-party-domain stock CLI authentication remain open.

Validation:

• Final-head full make check, container regression, make sqlc-generate, make openapi (no public spec drift), focused race suites and diff checks passed on zju_a100_2.
• Real PostgreSQL: single concurrent issuance winner, explicit rotation/revocation, foreign-tenant rejection, persisted digest, lifetime distinct from grants, restart, and deletion races. The UUID-alias HTTP regression fails without the canonical-identity check and passes with it.
• Unmodified Codex 0.153.4: actual registration and reconnection after registry restart; rotation closes its old socket and rejects its registration retries. Actual HTTP/WebSocket checks cover stale tickets, revocation and tenant isolation. These credential-only checks make zero model calls.
• Built operator executable: issuance, duplicate/foreign rejection, rotation and revocation against PostgreSQL.
• Independent build plus official Python SDK 3.13.0/raw HTTP suite against a read-only container passed; the new operator executable also starts as the image's default non-root user.
• Fresh, independent built-in full-diff review of the final head found no material scoped issues; the reviewer independently passed race, PostgreSQL, operator/native and four-binary build checks. Public Environment model acceptance remains outside this slice.