fix(agent): share extension adapters across workspace agents

[7155]

Summary

• bind cached Agent Extension adapters to the trusted Harness target and
  Extension installation instead of the logical workspace-agent:* ID
• allow multiple Workspace Agents to share one installed Extension while
  preserving their independent Agent identities
• keep cache matching fail-closed when either the trusted Harness target or
  Extension installation changes
• authorize resume using the same separation between logical Agent identity and
  trusted provider binding

Before this change, the first Workspace Agent using an Extension permanently
bound the provider-scoped adapter cache to its logical Agent ID. A second
Workspace Agent using the same trusted Harness then failed with
cached adapter binding mismatch until the daemon restarted.

Reproduction

1. Create two different Workspace Agents and configure both to use the same
   installed Agent Extension, such as Hermes Agent.
2. Restart Tutti so the provider adapter cache starts empty.
3. Start Agent A and complete one request.
4. Without restarting Tutti or its daemon, start Agent B and submit a request.
5. On current main, Agent B fails with
   cached adapter binding mismatch for "acp:hermes". Reversing the order after
   another restart makes B work and A fail instead.

Verification

• red before fix on upstream/main@6d4778dc4:
  TestRuntimeAdapterBindingAllowsWorkspaceAgentsToShareTrustedHarness
• green after fix:
  go test ./service/agentextension -run '^TestRuntimeAdapterBindingAllowsWorkspaceAgentsToShareTrustedHarness$' -count=1
• negative controls and resume coverage:
  go test ./runtime -run '^(TestOpenStandardACPAdapterCacheFailsClosedAcrossTargetBindings|TestControllerCanResumeAuthorizedAgentExtensionBinding)$' -count=1
• repository gate:
  pnpm check:changed -- --base upstream/main --push-ready (10 lanes passed)
• manual GUI A/B: in one daemon lifetime, Workspace Agent A and Workspace
  Agent B used the same Hermes Agent Extension and both completed real provider
  requests; before the fix, Agent B failed with the cache binding mismatch

Checklist

• This does not change Host lifecycle semantics; it corrects the trusted
  provider adapter binding used by an existing create/resume flow.
• I kept the change focused on one concern.
• No documentation update is needed because this restores the existing
  supported Workspace Agent/Extension behavior without changing setup or a
  public contract.
• No README or CONTRIBUTING files changed.
• I ran the lowest meaningful local checks for the changed surface.
• The commit is signed off with DCO.