feat(runtime): enforce protected candidate model grants

[drewstone]

What changes

• bind every candidate run to a frozen gateway-only or disabled network policy
• add the concrete reserve, activate, and settle adapter for short-lived model grants
• reject secret, identity, environment, model, limit, and retry drift at the runtime boundary
• reject candidate-authored model spans and reconstruct the only accepted spans from the closed router ledger
• require agent-interface 0.24.0 model-call provenance

Why

Structural self-improvement needs executable candidates to use models without receiving the evaluator parent credential or self-reporting usage. This makes model access bounded, revocable, and tied one-for-one to router-generated call identities and exact fixed-point cost.

Verification

• pnpm test: 147 files passed; 1,452 tests passed; 2 skipped
• pnpm run typecheck: passed
• pnpm run lint: passed
• pnpm run build: passed
• pnpm run verify:package: passed
• pnpm run docs:freshness: passed
• npm package check: @tangle-network/agent-interface 0.24.0 installed from the registry; no file or link dependency

[tangletools]

✅ Auto-approved drewstone PR — 311ed42a

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-11T06:51:57Z}