feat(resume): enable explicit safe-boundary resume by default in TUI and Desktop

## Problem

Maka already has a Runtime Host safe-boundary resume planner and public
`turn.resume.query` / `turn.resume.start` operations, but the production
composition currently requires `MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1`.

As a result:

- TUI `/resume` is unavailable in the default installation even when the
Runtime Host can safely continue the latest stopped Run.
- Desktop records a user Stop as an aborted/cancelled Turn, but does not offer
the existing safe-resume action on that outcome.
- Simply changing the existing boolean default would also enable model-driven
WorkHub resume delegation, which is a different authorization boundary and
can spend tokens without a fresh explicit user action.

## Desired outcome

- Explicit TUI and Desktop resume actions are available by default.
- Desktop offers `Continue this turn` after a Turn stopped through the
renderer Stop button.
- The Runtime Host planner remains the final authority: the UI does not assume
that a stopped Turn is safe to resume.
- Model-driven WorkHub resume delegation remains disabled by default.
- Operators retain an explicit kill switch for both forms of resume.
- Documentation states the default, opt-in and opt-out behavior accurately.

This issue is limited to activating and presenting the existing safe-boundary
resume path. It does not take ownership of:

- #3508: TUI resume picker/discovery work
- #4319: arbitrary Write/Edit recovery contracts
- #4424: permanently parked Run presentation
- #4325: broader Gitoxide continuity work

## Alternatives or workarounds

Set `MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1` manually. This enables the current
explicit resume path, but also enables WorkHub automated resume delegation and
does not add the missing Desktop user-Stop affordance.

AI assistance: OpenAI Codex traced the current Runtime Host, TUI and Desktop
resume paths and helped draft this issue.