Agent run lifecycle smoke from prepare to cleanup

[BramVR]

Parent: #70

What to build

Add an agent-run lifecycle smoke that exercises the Agent Run Contract from prepare through a harmless command and cleanup.

This should stay small but real: a managed workspace, a run contract, a benign command, captured output, run listing, and guarded cleanup.

Acceptance criteria

• The smoke prepares a managed agent workspace from isolated fixture state or a live public remote when live mode is enabled.
• It runs one harmless command inside the prepared workspace through the same runner/path CodeMesh expects agents to use.
• The run contract records command label, cwd, env binding summary, base provenance, exit code, duration, and output paths without embedding secrets.
• codemesh runs shows the lifecycle state before and after cleanup.
• Cleanup removes only CodeMesh-managed run paths and refuses paths outside the e2e temp boundary.
• The case has both offline fixture coverage and an opt-in live variant once the public-remote prepare smoke exists.
• Docs explain the difference between preparing a workspace and executing an agent run.

Blocked by

• Live e2e harness guardrails and report mode #88
• Agent Run Contract v1 baseline #73
• Agent Prep without source checkout #78

Cost guardrail

• Must stay free: harmless local commands and public/free live prerequisites only. No paid agents, providers, runners, or external services required for default completion.