feat/947 repository credential isolation

[sabbour]

Summary

• removes AgentHost Key Vault, CSI, shared-home, and repository token-store paths; the pod has no workload identity or service-account token
• restricts /configure to bounded Copilot inference material held only in AgentHost memory
• introduces a trusted API launch issuer that derives Copilot purpose from persisted run state and uses feat: add purpose-bound GitHub credential broker #944 snapshots with before/after broker fencing
• removes obsolete production configuration and documents NetworkPolicy as defense in depth rather than credential authority

Validation

• dotnet test tests\\Agentweaver.Tests\\Agentweaver.Tests.csproj -p:CopilotSkipCliDownload=true --filter "FullyQualifiedName~TwoAppCredentialArchitectureTests|FullyQualifiedName~KubernetesSandboxExecutorClaimTests|FullyQualifiedName~AgentHostConfigureIdentityTests|FullyQualifiedName~PreviewRunnerAuthAndScrubTests|FullyQualifiedName~AgentHostReadinessProbeTests" (54 passed)
• dotnet build tests\\Agentweaver.Tests\\Agentweaver.Tests.csproj --no-restore -p:CopilotSkipCliDownload=true
• kubectl kustomize k8s\\overlays\\production

Closes #947

[sabbour]

Closing this PR because it uses the replaced #947 design. The approved sandbox-governed design is tracked in #968.