design(agent-runtime): Deep Research toolful runner and Qwen adapter

Parent: #409

Design the signed contract delta required to integrate langchain-ai/open_deep_research as a real WorkspaceX Agent. This issue is design-only until human signoff; do not implement or claim runtime readiness.

Pinned upstream baseline:
- repository https://github.com/langchain-ai/open_deep_research
- commit d337ae32ed4ff8f4c6fbe192ba3bf1b2d6610799
- MIT, Copyright 2025 LangChain

Required decisions:
- WorkspaceX remains the canonical Agent / AgentRun / event / tenant fact source;
- `runtimeKind=deep-research` adapter backed by a separate Python 3.11 runner, not copied into the Cloudflare Worker;
- Qwen `qwen3.8-max` support through server-side DashScope secret refs and base URL, with real structured-output and tool-calling capability probes;
- organization-scoped search/tool broker, URL/redirect/DNS SSRF controls, prompt-injection isolation and citation normalization;
- queue, durable checkpoints, event cursor/reconnect, cancellation, late-result fencing, retry and terminal states;
- budgets for concurrency, search count, tool timeout, run timeout, tokens/cost;
- MCP by registered capability ID only; no arbitrary user URL and no runtime API keys in state/logs;
- deployment boundary for Cloudflare Worker/Queue/Workflow and isolated Python container;
- provenance/license/upstream upgrade lifecycle.

Deliverables:
- contract bundle (domain/use cases/API/coverage/design-signoff) and executable verification contract;
- screen → adapter → controller → application → queue → runner → event store matrix;
- feature split: Agent pack; tool broker/security; Python runner/Qwen gate; real E2E;
- explicit unavailable behavior before runtime prerequisites pass.

Counterexamples must include cross-org run/stream reads, private/link-local/metadata URLs, redirects/DNS rebinding, missing search/model, probe failure, budget exhaustion, cancellation with late provider response, duplicate terminal event and secret leakage.

No agent may change human signoff status. No runtime code in this issue.

Start with parent issue #409 and the pinned open_deep_research commit d337ae32ed4ff8f4c6fbe192ba3bf1b2d6610799. Map the requested screen → adapter → controller → application → queue → runner → event store layers into the contract bundle and executable verification contract; done requires human signoff, explicit unavailable behavior, and the listed counterexamples, with no runtime code.

Written by the indexing model from the issue text.