refactor(core): route remote exec through runtime port

[limityan]

Summary

• add a RemoteExecPort runtime contract and register remote exec capability through runtime services
• add a services-integrations remote SSH runtime-port adapter around the existing remote exec manager
• keep shell probing on the old bounded SSH one-shot path through RemoteExecPort::exec_command_once, preserving stdout/stderr separation and timeout behavior
• inject the remote exec port through desktop/CLI/server bootstrap assembly and desktop direct tool execution contexts
• route ExecCommand, WriteStdin, ExecControl, background input, remote shell probe, and env snapshot through injected runtime ports
• add boundary guards and focused tests for remote exec mapping, stdout-only shell probing, structured missing-session errors, and runtime capability registration
• update decomposition plan/completed docs and nearest layer docs to reflect the owner move

Risk

• Intended behavior is unchanged; managed remote command/stdin/control paths reuse the existing remote exec manager behind the port.
• Shell probing intentionally does not use the managed session table, so slow or timed-out probes do not create hidden remote exec sessions.
• The desktop direct tool API now injects the same remote exec port when executing tools for a remote workspace.
• No new third-party dependency is added; services-integrations only adds the internal bitfun-runtime-ports dependency under remote-ssh-concrete.

Verification

• subagent adversarial review from independent architecture and product perspectives; reviewed issues were fixed and re-reviewed
• pnpm run fmt:rs
• node --test scripts/check-core-boundaries.test.mjs
• node scripts/check-core-boundaries.mjs
• git diff --check
• cargo check -p bitfun-runtime-ports
• cargo check -p bitfun-runtime-services
• cargo check -p bitfun-services-integrations --features remote-ssh-concrete
• cargo check -p bitfun-core --features product-full
• cargo check -p bitfun-core --no-default-features
• cargo check -p bitfun-cli
• cargo check -p bitfun-server
• cargo check -p bitfun-desktop
• cargo test -p bitfun-runtime-services
• cargo test -p bitfun-runtime-ports
• cargo test -p bitfun-services-integrations --features remote-ssh-concrete remote_exec_runtime_port -- --nocapture
• cargo test -p bitfun-services-integrations --features remote-ssh-concrete remote_exec
• cargo test -p bitfun-core --features product-full remote_shell_probe_uses_stdout_only -- --nocapture
• cargo test -p bitfun-core --features product-full control_exec_command_session_returns_structured -- --nocapture
• cargo metadata --no-deps --format-version 1