fix(bridge): send the coordination MCP as a runtime attachment

[drewstone]

Why

A supervised bridge run serves its coordination MCP on a process-ephemeral port. driveHarnessFromBackend folded that URL into the AgentProfile it sent to cli-bridge, so the canonical profile digest moved every time the port changed. cli-bridge binds a durable session to the exact profile digest plus model, so a resumed manager was refused with session ... is bound to a different AgentProfile/model before it could spend a token — the incident in #774 (discovery run q36-classical-sharp-constant-flash-20260810a, Runtime 0.131.5, zero tool calls, zero spend).

The receipt layer already told the truth: platformAttachments are recorded apart from the authored profile. Only the wire lied.

What

• driveHarnessFromBackend no longer rewrites the profile. The authored profile reaches the wire exactly as authored; the reserved-alias check stays, so a profile that declares agent-runtime-coordination is still refused.
• The coordination endpoint travels on a new executor seam, bridgeRuntimeAttachmentsKey, beside bridgeStopSignalKey. bridgeExecutor sends it as runtime_attachments: { mcp: { … } } next to agent_profile (cli-bridge feat(attachments): carry runtime MCP attachments outside the bound profile drewstone/cli-bridge#181, server 0.3.0), which mounts it for the run and excludes it from the session binding, from receipt digests, and from durable-run identity.
• No silent fallback: when the bridge's capability document omits capabilities.runtimeAttachments.mcp, the capability preflight throws a ValidationError naming the bridge URL and the missing capability, before the first paid turn. The old profile-injection path is deleted, not kept behind a flag.
• authoredProfileFromDriverExecution — the helper that stripped the alias back out before comparing digests — is gone; the pending-executor check now compares the authored digest directly.

Proof

• pnpm run typecheck, pnpm run lint, pnpm run build, pnpm run check:api-surface (2087 exports, record current), pnpm run docs:check (no drift), pnpm run check:version-bump — all clean. The gate reports no consumer-visible surface change, so package.json stays at 0.143.0; the seam key is a module export, not a package export.
• pnpm exec vitest run tests/kernel/supervise-full-profile-bridge.test.ts tests/runtime/bridge-executor.test.ts tests/kernel/loop-dispatch.test.ts — 16 + 51 + 26 passed.
• The fake bridge now enforces the real session binding (first request records {profile digest, model}; a later mismatch answers 400). Re-injecting the coordination URL into the profile makes reuses one durable manager session on restart fail with that 400 — checked by patching the injection back in and re-running, so the test now proves what it claims.
• Full local suite: 2678 passed / 210 failed. The failures are Docker, sandbox, git-worktree, and 20s-timeout suites on a loaded macOS host running several agents (candidate-execution-*, improvement-*, mcp/local-harness, version-bump-check, and coordination-mcp's 127.0.0.53 bind, which fails identically on the base commit — EADDRNOTAVAIL). None touch the bridge path; CI is the authority.

Simplification

Simplification: one concept, one representation — the authored profile is no longer rewritten on the wire, so the receipt's platformAttachments split and the request finally agree; the strip-it-back-out helper (authoredProfileFromDriverExecution, 10 lines) is deleted along with the re-parse it forced.
Net: +229 / -48 lines across 6 files (src: +57 runtime.ts, -12 net supervise.ts), 1 helper and 1 profile-rewrite path removed.
Tests: +2 (sends runtime_attachments beside agent_profile and never inside it — a regression would put an ephemeral port back into the bound digest; refuses when the bridge does not advertise runtimeAttachments — an old bridge must stop the run instead of silently binding the port), -0 deleted. The existing restart test was left in place and made meaningful by the enforcing fake bridge rather than duplicated.
Not done here: peer-mail endpoints for bridge workers ride this same seam later (#889 gap 1); no second attachment kind is added now.

Closes #774

[tangletools]

✅ Auto-approved drewstone PR — a44fa8ac

This PR was opened by the trusted drewstone account.

This approval is provisional and was applied by the local stand-in because the pr-reviewer webhook host is unreachable (2026-08-21). CI on this head is fully green. The full PR reviewer audit re-runs via the resweep when the service returns and will publish findings if it detects issues.