Fix BridgedAgentWorkflow run names exceeding Kubernetes' 63-byte label limit

[imaustink]

Summary

BridgedAgentWorkflow names each run "agentrun-" + agentId + "-" + uuid.NewString() — 9 + len(agentId) + 1 + 36 bytes. For claude-code-swe-agent (21 bytes) that's 67 bytes, over Kubernetes' 63-byte label-value limit. core-controller's reconciler uses this name directly as the Job name (and therefore the API server's auto-added job-name label), so it rejects the Job on every single reconcile attempt: "must be no more than 63 bytes". The AgentRun CR gets created and then sits forever with no phase and no Job.

This is a real, currently-live production blocker, found while debugging a live report: with the bridged-workflow routing fix (#204/#205) and its dependent config wiring all correctly in place, a real chat turn now authorizes correctly (verified via the worker's own logs: verdict=authorized, real principal resolved) and starts a real BridgedAgentWorkflow — and then silently stalls at this exact point, forever, with no visible error surfaced to the caller (the turn just eventually reports something like "I couldn't complete the goal within my step budget" once its own turn budget runs out waiting for a reply that can never come).

e2e coverage never caught this because bridged-agent-workflow.e2e.ts's stand-in agent (stub-agent, 10 bytes) fits comfortably within the limit — nothing exercised an agent ID long enough to reproduce it.

Fix

newAgentRunName truncates the agent ID portion — never the uuid, which is what actually provides uniqueness — whenever the natural "agentrun-<agentId>-<uuid>" form would exceed the 63-byte limit, so the bound holds for any agent ID length rather than only the ones e2e happened to test with.

Test plan

• New unit tests (agentrun_name_test.go) pin the exact reproducing case (claude-code-swe-agent), verify the uuid suffix is always intact (never truncated, so uniqueness is preserved), and verify short IDs are unaffected
• Updated bridged_agent_workflow_test.go's existing assertion, which expected RunID to contain the full agent ID string — no longer true once truncation is necessary for this specific (real, 21-byte) agent ID
• go build ./..., go vet ./..., gofmt -l ., go test ./... all clean in engines/temporal
• bridged-agent-workflow.e2e.ts still passes against minikube (unaffected — its stand-in agent's ID is short enough that truncation never triggers, confirming this is purely additive)