CL-6471: never leak a run id as a participant's name or greeting

[TheGreatAxios]

Root cause

Two symptoms, one source. Instantiating the code-review template on a fresh stack, the setup agent's participant record rendered as "Run 737a058d48006e2bde12559576f422e0" and its canned greeting read "I'm run_737a058d48006e2bde12559576f422e0. Three reviewers read every pull request..." (the template's own promise line, packages/workflow-catalog/src/templates.ts).

Both trace to packages/chat/src/workbench-service.ts's launchAndJoinAgent: the invited definition's display name came from the caller's pre-fetched listInvitableDefinitions() snapshot. When that snapshot missed the definition -- a just-created or just-redeployed row it predates, exactly the "fresh stack, instantiate a template" race -- the handle silently fell back to localPartOf(launched.address) (the run's own address). packages/chat/src/routes.ts's greeting resolution (agentDisplayName) had the identical fallback, feeding the same leaked value into cannedGreeting's "I'm ${agent}" template.

Neither deriveDisplayName/humanizeSlug (CL-6413, PR #158) reached this path because they lived in @corbits/agent-directory, which already depends on @corbits/chat -- a reverse import would have been circular.

Fix

1. Moved deriveDisplayName/humanizeSlug into @corbits/chat/display-name (the canonical home now); @corbits/agent-directory/client.ts re-exports them for its existing callers.
2. Added WorkbenchLauncher.resolveDefinitionNameSource -- a live, authoritative lookup resolveInvitedDisplayName falls back to when the invitable snapshot misses, instead of ever degrading to a raw address/run id. Both launchAndJoinAgent's participant handle and routes.ts's greeting name now resolve through it (launchAndJoinAgent now returns displayName so the greeting never re-derives it from a possibly-stale snapshot).
3. Systemic guard (packages/chat/src/id-leak-guard.ts): assertNoLeakedInternalId matches run_/wfd_/tnt_/prn_/ast_/gtk_ in both raw and humanized ("Run 737a058d...") form, wired into deriveDisplayName and cannedGreeting so either throws loud rather than rendering a leaked id.

Tests added

• packages/chat/src/id-leak-guard.test.ts -- all six prefixes, raw and humanized forms, no false positives on ordinary prose ("Runner McRunface").
• packages/chat/src/display-name.test.ts -- deriveDisplayName throws rather than humanizing a run id into a fake name.
• packages/chat/test/workbench-service.test.ts -- a definition missing from the invitable snapshot still resolves its real name via the live lookup (never "ins_invited1"); a definition unresolvable anywhere fails loud rather than leaking.
• packages/chat/test/routes.test.ts -- the exact CL-6471 scenario: definition missing from the snapshot still greets with its real name ("I'm Myra"), never the run's own address.

Updated 7 pre-existing tests that had encoded the old fallback as expected behavior (a participant handle of "ins_invited1", a greeting saying "I'm echo" instead of "I'm Echo").

Scoped checks (green)

• packages/chat: bun run typecheck clean, bun test -- 637 pass / 24 skip / 0 fail.
• packages/agent-directory: bun run typecheck clean, bun test -- 147 pass / 21 skip / 0 fail.
• prettier --check / eslint clean on every touched file.

Live proof: PENDING

The machine hosting this session is memory-constrained (24GB, many concurrent lanes) and another lane currently holds the only available live-stack slot; the owner's own stack on :3000 was explicitly off-limits. Per the coordinator's instruction I verified statically (unit/component tests above) rather than booting a scratch stack, and did not merge this PR.

To get live proof, on a machine with a free slot:

# From a fresh worktree of this branch:
createdb workbench_cl6471   # or any unused scratch DB name
cat > .env <<'ENV'
DATABASE_URL=postgres://localhost:5432/workbench_cl6471
BASE_URL=http://localhost:3471
PORT=3471
SESSION_SECRET=insecure-dev-only-session-secret-0000
HUB_DATA_DIR=.data/hub-cl6471
HUB_STATIC_DIR=../web/dist
ENV
bun run build   # produce apps/web/dist once
bun run dev

Then sign in with the seeded admin, create a workbench from the "Code review" template, and confirm: the three reviewer agents (and Myra) appear with their real names (never "Run ..."), and the opening greeting reads "I'm Myra. Three reviewers read every pull request..." (never "I'm run_...").

Fixes CL-6471.