feat(skill): default iac-code pipeline to solution-first

[guima-why]

Summary

• default the external iac-code Skill's Pipeline mode to selling_solution_first, while preserving explicit selling configuration
• expose Pipeline and normal-mode A2A input boundaries without answering permissions or selections on the user's behalf
• preserve resumable normal permission state across staged-backup retries
• align the Skill-owned runtime with tool-level handoff confirmation while retaining the existing durable runtime key and state directory

Compatibility

• handles retryable SESSION_BACKUP_NOT_READY responses without losing the pending permission envelope
• safely replaces an older Skill-owned runtime only after PID, token, and health verification
• fails closed for malformed or unverifiable runtime records instead of starting a second process on the same durable state
• retains all upstream i18n entries from main

Verification

• uv run pytest -q tests/skill_bridge tests/pipeline/engine/test_pipeline_handoff.py tests/a2a/test_task_store.py tests/a2a/test_executor.py tests/services/test_permission_wait.py (574 passed)
• uv run ruff format --check skills/iac-code/scripts/iac_code.py tests/skill_bridge/test_iac_code_bridge.py
• uv run ruff check skills/iac-code/scripts/iac_code.py tests/skill_bridge/test_iac_code_bridge.py
• uv run ty check src/
• git diff --check