Require explicit cloud opt-in for tc run (CR-DD-009)

[coreytshaffer]

Summary

Hardens CR-DD-009 by separating privacy eligibility from cloud execution authorization.

Before this patch, c run --privacy external_safe or --privacy public could set �xternal_model_allowed=True, which meant the new operator-facing c run surface could reach the existing Qwen cloud branch when enabled. This patch requires an explicit --allow-cloud flag before c run authorizes cloud execution.

Behavior

• --privacy local_only -> �xternal_model_allowed=False
• --privacy external_safe -> �xternal_model_allowed=False unless --allow-cloud
• --privacy public -> �xternal_model_allowed=False unless --allow-cloud
• --privacy external_safe --allow-cloud -> �xternal_model_allowed=True
• --privacy public --allow-cloud -> �xternal_model_allowed=True
• --privacy local_only --allow-cloud -> exits 1 with a clear error

Scope

• Adds --allow-cloud to c run
• Adds focused offline tests for cloud-authorization behavior
• Clarifies CR-DD-009 documentation

Non-goals

• No new cloud providers
• No Qwen backend changes
• No frontier backends
• No budget enforcement
• No cockpit changes
• No backlog or changelog mutation

Validation

• python -m pytest -q tests/test_tc_run_cli.py -> 11 passed
• python -m pytest -q tests/test_client.py tests/test_privacy_scanner.py tests/test_route_decision_audit.py -> 29 passed
• cached diff contained exactly the three approved files
• cached whitespace check passed