Add runtime-resolving run execution entry point

Why are we doing this?

Duo agents run on two engines: a CI runner (heavyweight -- Docker environment, repo clone, shell) or Workhorse (lightweight, in-app, API-only, acts as the user). Today every surface (Slack, @GitLabDuo mentions, webhooks) wires its own path to them. The long-term goal is two feature-complete, interchangeable engines behind one entry point: hand it a session and what just happened -- the user replied, or approved/denied a tool -- and it picks the right engine. The first consumer is approving a Duo's tool call from Slack.

What does this MR do?

Introduces that entry point, Ai::DuoWorkflows::ExecuteRunService, plus the event it accepts (RunEvent: input for a first turn or a reply, approval for a tool or plan decision) and Workflow#last_runtime, which derives where the session last ran so continuations stay on their engine. It validates the event against the session state, checks the flow's coding environment against the runtime, then delegates: CI keeps its existing StartWorkflowService/ResumeWorkflowService, Workhorse enqueues the existing turn worker.

Purely additive -- nothing calls it yet. It unblocks !255538 (merged) (Slack approvals), and the Slack adapter switch-over follows in !256183 (merged).

References

• Issue: #628435 (closed)
• Epic: gitlab-org#23521
• Unblocks: !255538 (merged)

How to set up and validate locally

Specs run in CI. To poke it by hand in a GDK console (bundle exec rails console):

wf = Ai::DuoWorkflows::Workflow.last # any session, e.g. one started from Slack
Ai::DuoWorkflows::ExecuteRunService.runtime_for('slack_assistant/v1') # => :workhorse
wf.last_runtime # => :workhorse (no CI workloads) or :ci

# A first turn on a fresh session enqueues the turn worker:
Ai::DuoWorkflows::ExecuteRunService.new(wf, event: { type: :input, text: 'hi' }).execute

End-to-end verification lives with the wiring in !256183 (merged).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.