agent-core-v2: spill files unreadable on non-local runtimes

Problem

Follow-up from #3227 (raised by codex review).

ToolResultTruncationService persists spill files through the app-host IFileSystemStorageService and hands the model an absolute output_path under the host's bootstrap.homeDir (packages/agent-core-v2/src/agent/toolResultTruncation/toolResultTruncationService.ts). The suggested recovery path is the Read/Grep tools, which read through the agent's bound runtime filesystem (readTool.ts reads via lease.runtime.fs). kaos supports non-local runtimes (SSH, containers — see packages/kaos/src/kaos.ts), where the host path does not exist: the model receives a recovery pointer it cannot read.

Affects both the pre-existing legacy spill branch and the untruncatedOutput retention branch added in #3227. Local runtimes are unaffected.

Candidate directions

• A. Persist the spill in the bound runtime. Write through the runtime fs instead of the host store. Tension: v2 persistence layering routes business persistence through the blessed Stores, and a remote fs may be ephemeral.
• B. Keep host-side storage, reroute readers. Read (and Grep) detect spill paths via the existing isSpillFilePath and read from the host-side store instead of the runtime fs. Keeps a single storage owner; both tools need the special-case, and the permission/path-access layer must agree.
• Possibly a hybrid: A when the bound runtime is durable/local, B as the general read path.

Acceptance

On an agent bound to a non-local runtime, a truncated tool result's spill pointer is actually readable by the model through the documented next_step (Read and Grep), or the pointer text adapts to the runtime context.

Start with packages/agent-core-v2/src/agent/toolResultTruncation/toolResultTruncationService.ts and readTool.ts, then inspect the runtime filesystem path in packages/kaos/src/kaos.ts and the existing isSpillFilePath handling. Compare the host-storage and bound-runtime approaches, including Grep and permission/path-access behavior. Done means Read and Grep can retrieve truncated spill output on non-local runtimes through the documented next_step.