Reorganize worker runtime layer into worker/runtime/ (M8 part 2/3)

Groups the pi Agent lifecycle, factory, signature contract, and env/redaction helpers into src/main/worker/runtime/. WorkerRunner is the module's public entry and lives in runtime/index.ts; pi-agent-factory and pi-hook-contract stay named for their role as visible runtime boundaries; helpers.ts carries ParentMessage/ChildMessage/RunJob types plus redactor + env override utilities. entry/index.ts and agent-runtime/runtime-message-injector.ts updated to import from the new paths.

src/main/worker/entry/index.ts

@@ -1,6 +1,6 @@
-import type { ChildMessage, ParentMessage, RunJob } from "../worker-helpers";
+import type { ChildMessage, ParentMessage, RunJob } from "../runtime/helpers";
 import { WorkerRpcClient } from "./rpc";
-import { WorkerRunner } from "../worker-runner";
+import { WorkerRunner } from "../runtime";
 
 const parentPort = process.parentPort;
 

src/main/worker/entry/rpc.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import type { ChildMessage } from "../worker-helpers";
+import type { ChildMessage } from "../runtime/helpers";
 
 interface PendingRpc {
   resolve: (value: { ok: true; result: unknown } | { ok: false; error: string }) => void;