Extract misfiled code out of packages/folded-runs

[TheGreatAxios]

Summary

Two independent reviews found that packages/folded-runs is not the ~1,000
line "renders source from a stored projection" package its description
suggests — it's 2,806 source LOC across 13 files, of which only
definition.ts (~342 LOC) actually reads the folded projection. The rest is
real domain logic that has nothing to do with folded runs and was simply
misfiled. This PR moves the three misfiled slices out, as a pure refactor
with zero behavior change. It does not touch definition.ts itself — a
later epic wants to delete the foldedBody-reading slice, and that's blocked
and out of scope here.

• @corbits/agent-events — connectorReplyContent, inferenceDoneBlocks,
  toolDoneResult, messageRunStarted, messageRunEnded: recognizers for
  sidecar agent.event frames. Zero dependencies (didn't import anything
  before the move either), so trivially browser-safe. Actual importers,
  verified by reading the import graph rather than trusting grep-for-mentions:
  packages/chat/src/chat-orchestrator.ts and
  packages/tasks/src/orchestrator.ts. (chat-ui, slack-tag, github-tools, and
  workflows/workbench-digest only mention these functions in comments — they
  don't import them. slack-tag even carries its own mirrored copy of
  connectorReplyContent rather than importing the real one.)
• @corbits/folded-run-one-shot — runOneShotFoldedPrompt, a synchronous
  request/reply runner over one folded run's opening turn with teardown on
  every exit path. Depends on @corbits/folded-runs' public exports
  (readDefinitionProjection, readFoldedBody, launchFoldedRun,
  sendFoldedMailWithRetry, CryptoProviderCache, FoldedRunsDeps) and on
  the new @corbits/agent-events. Consumed by @corbits/routines and
  @corbits/task-planner directly; apps/hub/src/index.ts's 4 call sites
  already went through @corbits/task-planner's re-export barrel (not
  @corbits/folded-runs directly), so hub's import of the function itself
  needed no change.
• @corbits/run-scope — createTopLevelRunRoutes, listTopLevelRuns,
  listTopLevelRunFires: the HTTP route answering "which of this tenant's
  workflow runs are genuine top-level deployments," mounted once in
  apps/hub/src/index.ts. Its only folded-run-specific coupling is a
  NOT EXISTS/LEFT JOIN against folded_run, now read through
  @corbits/folded-runs' public foldedRun export.

All 18 external importer files and 8 package.json workspace deps are
repointed at the new packages. No re-export shim is left in folded-runs.
folded-runs' own package.json drops hono, @corbits/agent-lifecycle,
and @intx/log — each was only used by one of the three moved slices — and
gains a "./migrations" export subpath so the relocated
run-scope/test/scope-routes.drizzle.test.tscan reachapplyFoldedRunsMigrationsthrough the package boundary instead of a relativesrc` import.

Before/after LOC (packages/folded-runs/src, non-test):
2,806 → 1,986. Split out: agent-events 173, folded-run-one-shot 278,
run-scope 338 (small deltas from header-comment path updates, index.ts
barrels).

Known wart, not touched: scripts/db-setup.ts:32-34 imports
applyFoldedRunsMigrations/backfillFoldedRunMarkers from
packages/folded-runs/src/migrations by relative path, bypassing the
package's own exports map. migrations.ts never moved, so this import is
unaffected by this PR — flagging per the review, not fixing here.

Bug spotted, deliberately not fixed: none found in the moved code itself
— this was a pure location change with no logic edits.

Test plan

• bun run check (typecheck, lint, tests, all repo checks incl.
  check:licenses and check:browser-safe-subpaths) passes clean from
  the repo root.
• bunx prettier --write over every changed file (no-op — already
  formatted).
• Verified no stale imports of the moved symbols remain anywhere under
  apps/, packages/, workflows/, scripts/.