Preserve hibernated agent identity across undeploy/redeploy (CL-6581)

[TheGreatAxios]

Summary

CL-6581, built on the spike in PR #291 -- wires the snapshot/restore
technique into the real workflow-host-wiring undeploy/deploy hooks,
gated on the existing reclaimDirs flag. This is a compensating
workaround, not a substitute for CL-6239 (still open: the real fix is
a non-destructive upstream undeploy in @intx/hub-agent).

The bug this closes: the published @intx/hub-agent package's
handleAgentUndeploy (ws/hub-link.js) unconditionally destroys an
agent's on-disk identity directory -- including its reconnect-challenge
Ed25519 keypair under agentDir(dataDir, address)/keys/ -- on every
sendAgentUndeploy, hibernate or not, and that delete happens AFTER
this sidecar's undeploy hook returns. Losing that keypair is the
documented root cause of CL-6203/CL-6044: a woken agent mints a fresh
identity and fails the hub's reconnect challenge.

What changed

• New apps/sidecar/src/hibernated-agent-identity-vault.ts:
  snapshotAgentIdentity / restoreAgentIdentity / reapExpiredHibernationSnapshots,
  built on agentDir(dataDir, address) -- @intx/hub-agent's only
  stable public export for this path.
• workflow-host-wiring/index.ts: teardownDeployment snapshots the
  identity directory when reclaimDirs is false (the hibernate
  flavor), before anything else runs, since the destructive delete
  happens right after this hook returns. spawnWorkflowDeployment
  restores it before the loadOrGenerateKey call, and reports through
  reportError if a restored snapshot still yields a fresh keypair
  (isNew: true) -- a broken-restore signal that must never fail
  silent.
• A new reapExpiredHibernationSnapshots router method, run once at
  boot (apps/sidecar/src/index.ts), reclaims any snapshot whose
  address hibernated and was never redeployed within the retention
  window, so an abandoned hibernate does not leak disk forever.

Safety

• The snapshot holds private key material. It lives under this
  sidecar's own data dir (never a served/public path), hardened to
  0700 (dirs) / 0600 (files) -- matching the precedent in
  workflow-deployment-record.ts's writeWorkflowDeploymentRecord --
  and is never logged or included in an error message.
• Retention: 30 days
  (HIBERNATION_SNAPSHOT_RETENTION_MS), generous relative to any
  expected idle-sleep duration (hours to low days), swept once at boot,
  independent of and without touching the unrelated deployment-record
  boot-restore scan or its concurrency.
• This technique depends on @intx/hub-agent's undeploy call
  ordering (delete happens after our hook returns). If a future
  package bump reorders that, agentDir would already be gone by the
  time a hibernate teardown reaches the snapshot step -- that is
  detected and reported through reportError immediately, rather than
  silently making every subsequent wake mint a fresh identity (the
  exact CL-6203 bug class).

Test plan

• apps/sidecar/src/hibernated-agent-identity-vault.test.ts --
  snapshot/restore/reap against the real, unmodified
  @intx/hub-agent key/repo stores; permission hardening; the
  ordering-broke report path (mocked reportError); retention-based
  reaping.
• apps/sidecar/test/workflow-suspend-identity-preservation.test.ts
  -- end-to-end through the real createSidecarDeployRouter wiring:
  a hibernate teardown + real AgentRepoStore.remove + redeploy
  loads back the identical keypair; a reclaiming teardown still
  destroys it.
• bun run check (typecheck, lint, test, check:structural)
  passes clean from the repo root.

Scope

Does not touch idle-sleep policy, packages/folded-runs, or the boot
restore loop's concurrency -- those are other lanes' work. The only
shared files touched are apps/sidecar/test/support/workflow-lifecycle-fixture.ts
(added an optional real-key-store override, and made the default fake
key store create a real agentDir so it doesn't spuriously trip this
change's ordering-broke detector) and apps/sidecar/src/workflow-host-wiring/index.ts
(the teardownDeployment/spawnWorkflowDeployment hooks this PR is
about).

Linear: CL-6581. CL-6239 stays open -- commented there noting this
compensating fix and its dependency on upstream call ordering.