Bake the new harness CLIs into the Modal worker image and report per-harness cloud readiness

Part of #653. Rescoped: the capability-contract half is struck (Smithers already ships it), and the sandbox-runner half is deferred to #661.

Problem

The Modal worker image installs only the Codex, Claude Code and Kimi CLIs. Any harness added by #659 or #662 is therefore missing from the default image, and the property 'the first run in a cold container performs no package installation' fails for it. The doctor's agent-ref-to-binary map likewise covers only the four legacy refs, so cloud readiness for a new harness is unreported.

Scope

1. Add the pinned Pi and OpenCode packages to the global install line in packages/modal/Dockerfile, alongside the existing pinned Codex / Claude Code / Kimi entries, at the same versions the local adapters qualify against.
2. Pre-create the run-scoped state roots those adapters use, so a cold container installs and downloads nothing on first use.
3. Extend AGENT_EXECUTABLES in packages/runtime/src/doctor.ts for the new refs and reuse the existing Modal command-probe path in packages/modal/src/node-provider.ts to report per-harness cloud readiness. Delegate capability truth to smithers agents doctor / capabilities / test — do not define a second contract, do not restate flags or option mappings.
4. Extend the hardcoded four-agent enums in the Modal package (config, launch state, defaults, workspace config) only for harnesses that must actually run in the cloud.
5. Prove local and Modal agree by running the same smoke prompt in both places for each new harness.

Acceptance criteria

• A cold worker container runs each supported harness with zero package installation or catalogue download.
• ultrafuzz doctor reports, per harness, whether it is reachable locally and present in the image.
• No ultrafuzz-side capability schema is introduced.

Deferred

Every sandbox-runner acceptance criterion (bwrap / Landlock rung selection, per-arch launcher package presence, build-time failure when no rung is usable) is deferred until #661 is resolved. If #661 is closed or goes upstream, they are dropped entirely.

Dependencies

One of #659 or #662 must land first so there is a harness to bake.

Start with packages/modal/Dockerfile and the existing run-scoped state setup, then inspect AGENT_EXECUTABLES in packages/runtime/src/doctor.ts and the Modal command-probe path in packages/modal/src/node-provider.ts. Extend the relevant Modal enums and verify each supported harness with the same smoke prompt locally and in a cold worker; done means no installation or catalogue download and per-harness doctor readiness is reported.