Issue run-scoped capabilities for async polling

[wsr3005]

Summary

• let source-authenticated async callers explicitly request a run polling capability with runAccess=capability
• return an audience-, actor-, and run-bound capability in the existing capability response header
• allow that capability to read only its exact run while preserving the Portal identity path for normal source-authenticated reads

Security properties

• source authentication alone still cannot bypass the Portal identity gate
• production tokens use the isolated capability secret and expire after one hour
• ordinary async turn requests receive no capability
• a capability for one run returns not found for every other run

Verification

• 96 affected tests pass
• TypeScript typecheck passes
• ESLint, Oxlint, Prettier, and git diff --check pass
• independent spec and standards/security reviews report no findings

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}