Add reference agent runners (run_worker / serve_queue)

[Jacobobber]

Reference agent runners (run_worker / serve_queue)

The reusable worker loop a served agent runs — shipped once instead of rewritten per agent. hallpass provisions the identity, scope, channel, and durable queue, but it runs no model loop of its own (that's deliberate). What a spawned agent still needs is the loop around its work — claim/receive, run, report, heartbeat, stop — and that loop is the same whichever model (or none) sits inside a handler.

• serve_queue(queue, worker, handlers, …) — claims one task from a TaskQueue per pass, dispatches to handlers[task.do], and completes it. The handler's returned mapping becomes the result fields (ok=True); an unknown operation completes ok=False note "no handler"; a raising handler completes ok=False with only the exception type as the note, never its message (mirrors the orchestrator Worker). Idempotent + lease-safe, so an expired-lease re-run can't overwrite a recorded result.
• run_worker(worker, …) — the same loop over an A2A Worker/channel.

Both take:

• stop predicate and/or max_idle_rounds — serve-forever or drain-and-return (neither set ⇒ drain once and return, never a busy-spin).
• an injectable sleep — the loops test without wall-clock waits.
• a heartbeat hook — wire bus.announce into it to hold a live-roster seat, tying serving and presence (v1.7) together.

The auth boundary is unchanged: a handler acts with the agent's scoped token. The handler is exactly where a model or tool call would go.

Verification

• tests/test_runner.py — 10 tests: drain-and-return with no termination, stop predicate, max_idle_rounds ends an idle loop (with the right sleep count), heartbeat called each pass, heartbeat holding a roster seat; queue: completes tasks, unknown-op clean fail, handler error reports type only (message not leaked), stop leaves the backlog for another worker, drain-then-return.
• examples/reference_agent.py runs and prints completed 3 tasks; roster now ['resizer-1'].
• Full suite 320 passed (+10). mypy --strict, ruff, catalog freshness all green.

Additive. Rounds out the coordination layer (spawn → route → queue → serve), all on the one auth core.