refactor: validate product SDK assembly boundary

[limityan]

Summary

• add the explicit Sdk delivery profile as a no-direct-core product shape and keep architecture docs aligned with the full profile set
• let ProductRuntimeParts hand owned RuntimeServices and HarnessRegistry into Agent Runtime SDK builders
• add product assembly to Agent Runtime SDK smoke coverage for both SDK no-direct-core and CLI product-full compatibility profiles
• tighten boundary rules and self-tests so agent-runtime stays independent from product assembly facts and concrete tool/platform/provider runtime crates

Risk and compatibility

• Existing product profiles keep their current capability matrix.
• The SDK profile selects no product-full capabilities and uses injected runtime services only.
• bitfun-agent-runtime is a dev-dependency only for product-capabilities smoke coverage; no normal dependency back-edge is introduced.
• Documentation changes are target-state consistency updates for profiles and ProductAssembler consumers.

Validation

• pnpm run fmt:rs
• cargo test -p bitfun-product-capabilities
• cargo test -p bitfun-agent-runtime
• cargo test -p bitfun-core --features product-full product_tool_runtime_keeps_no_direct_core_profiles_empty
• node --test scripts/check-core-boundaries.test.mjs
• node scripts/check-core-boundaries.mjs
• cargo check -p bitfun-core --no-default-features
• cargo check -p bitfun-core --features product-full
• cargo check --workspace
• cargo metadata --no-deps --format-version 1
• pnpm run check:repo-hygiene
• git diff --check

Refs #970