feat(agent): add profile materialization contracts

[drewstone]

Summary

• add shared AgentProfile materialization contracts for full-profile, prompt-only, and prompt+resources run paths
• expose assert/validate helpers so limited transports fail before dropping tools, MCP, permissions, hooks, model, or other profile axes
• wire createSandboxAct to validate optional requiredProfileAxes and document the new API surface

Verification

• pnpm exec vitest run tests/profile-materialization.test.ts tests/sandbox-act.test.ts: 14 passed
• pnpm run lint: passed
• pnpm run typecheck: passed
• pnpm run build: passed
• pnpm run docs:check: passed
• pnpm test: 127 files passed, 1254 tests passed, 2 skipped
• pnpm run verify:package: passed
• git merge-tree --write-tree origin/main HEAD: passed

[tangletools]

✅ Auto-approved drewstone PR — 018e4eba

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-07T20:19:18Z}