feat(agent): add typed-result-v1 and fail-closed remote parser

Remote /v1/run now emits additive result_v1; Go validates run_id, digest, and paths before materializing, and only accepts missing typed payloads with an explicit legacy handshake.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.dev.yml

@@ -67,6 +67,7 @@ services:
       - ./data/dev/workspaces:/app/data/workspaces
       - ./data/dev/agent_sessions:/root/.pi/agent/sessions
       - ./deploy/pi-agent/runner.mjs:/app/runner.mjs:ro
+      - ./deploy/pi-agent/result-v1.mjs:/app/result-v1.mjs:ro
       - ./deploy/pi-agent/extensions:/app/extensions:ro
     tmpfs:
       - /tmp