Phase 003: remove the coding-agent and ekko-agent runtimes

Every chat session now runs through the Hermes bridge, so the three chat
chains become feature-equivalent instead of three partially-maintained
dispatch paths. Keeping the coding-agent and in-house agent runtimes alive
meant every bridge change had to be mirrored into two more runtimes that
had already drifted.

Historical rows are read, not migrated: sessions stored with the retired
source normalize to cli on load, workflow graphs naming the retired agents
keep loading and run on the bridge, and the visible-source check plus
SOURCE_LABELS still recognize the old value so those sessions stay listed.

The public surface follows the code: the OpenAPI generator and the MCP
chat-run tool schema drop the six retired entry fields so external callers
are not told about runtimes that no longer exist.

harness-check gains a RETIRED_RUNTIME scan so the residual check is a
mechanical gate instead of a manual grep, with the two surviving read-side
compat sites recorded with reasons.

Refs: docs/phases/phase_003.md

tests/server/usage-recorder.test.ts

@@ -96,8 +96,8 @@ describe('usage recorder', () => {
     recordSessionUsage({
       sessionId: 'session-1',
       runId: 'run-1',
-      source: 'coding_agent',
-      agent: 'codex',
+      source: 'hermes',
+      agent: 'hermes',
       profile: 'work',
       model: 'gpt-5',
       provider: 'openai',
@@ -106,8 +106,8 @@ describe('usage recorder', () => {
 
     expect(updateUsageMock).toHaveBeenCalledWith('session-1', {
       runId: 'run-1',
-      source: 'coding_agent',
-      agent: 'codex',
+      source: 'hermes',
+      agent: 'hermes',
       usageScope: undefined,
       apiCalls: undefined,
       inputTokens: 10,