Add Runtime Extension API v0.1

[0YHR0]

What changed

• added the trusted in-process Runtime Extension API v0.1 with manifests, controlled core-service context, exact service surfaces, entry-point discovery, lifecycle health and stop callbacks
• added extension ID, workspace, asset and core-route collision validation plus explicit enable/disable configuration
• exposed GET /api/v1/extensions for operator-facing version, health, Feature, Credential, permission and workspace disclosure
• migrated Music Studio service creation, routes, workspace and Company Template projection onto the generic extension boundary
• documented the trust boundary, third-party entry-point contract and deliberate v0.1 limitations

Why

The previous package separation still required AgentMesh core composition code to import Music Studio directly. This protocol makes the core scenario-neutral enough to load independently distributed trusted scenarios without changing their public URLs.

User impact

Music Studio remains enabled by default and all existing URLs remain unchanged. Operators can set AGENTMESH_RUNTIME_EXTENSIONS= to disable installed extensions or inspect their effective status through the new API. Disabled workspaces and services fail closed with HTTP 503.

Validation

• ruff check src tests
• 426 non-PostgreSQL tests passed
• 83.25% line coverage (80% gate)
• Compose configuration validation passed
• wheel build verified to contain the extension SDK/runtime and Music Studio assets