Guard runtime model mode fallback

[nexicturbo]

Fixes #3458

Summary

• add a strict runtime model-mode resolver for AO_MODEL_MODE with supported modes only: chat, completion, embedding, rerank, and tools
• resolve unsupported, missing, uppercase, whitespace-padded, or traversal-like model modes to chat before subprocess launch
• record sanitized routing decisions per agent without copying private environment values or task payloads
• preserve a single terminal runtime outcome: successful launches settle at RUNNING, failed launches settle at CRASHED without storing a process handle
• include current-main suite-health fixes for AgentStatus export and metrics RLock/min/max snapshots so the validation suite imports and completes

Validation

• PYTHONDONTWRITEBYTECODE=1 uv run pytest tests/test_runtime.py -q -> 10 passed
• PYTHONDONTWRITEBYTECODE=1 uv run pytest tests/test_runtime.py tests/test_agent_registry.py tests/test_metrics.py -q -> 22 passed
• PYTHONDONTWRITEBYTECODE=1 uv run pytest -q -> 32 passed
• PYTHONDONTWRITEBYTECODE=1 uv run pytest --cov=src --cov-report=term-missing -q -> 32 passed, total 42%, src/agent/runtime.py 82%
• PYTHONDONTWRITEBYTECODE=1 uv run flake8 src/agent/runtime.py tests/test_runtime.py src/agent/__init__.py src/common/metrics.py -> passed
• python3 -m py_compile src/agent/runtime.py tests/test_runtime.py src/agent/__init__.py src/common/metrics.py -> passed
• python3 -m compileall -q src tests -> passed
• uv build -> passed
• git diff --check -> passed
• Red proof against upstream/main runtime model-mode markers -> no matches
• High-risk secret-pattern scan over diff -> no matches
• Star gate: viewerHasStarred -> true

Note: full-repo flake8 still reports pre-existing lint in untouched files; touched-file flake8 passes.

No secrets, tokens, hidden context, private runtime payloads, or payout details are included.