Add fail-closed steering activation preflight

[mdheller]

Summary

Adds the first GPT-2 Small controlled-activation entrypoint for Issue #34 without claiming real activation is complete.

This PR does not close #34. It adds the fail-closed real-path surface that #34 needs before the actual activation injection implementation and smoke proof can land.

What changed

• Adds optional runtime dependency list in requirements-steering.txt.
• Adds src/agent_machine/steering_runtime.py.
• Adds sourceset-aware readiness preflight:
  • agent-machine steer preflight --sourceset gpt2-small.res-jb
• Adds sourceset-aware local endpoint entrypoint:
  • agent-machine steer serve --sourceset gpt2-small.res-jb --host 127.0.0.1 --port 8080
• Keeps agent-machine steer serve-stub intact as the no-weights fallback.
• Updates make validate to exercise steer preflight through Python and bootstrap CLI paths.
• Adds docs/steering-activation-path.md.
• Links the activation-path doc from docs/index.md.

Boundary discipline

This PR does not:

• return status: applied
• load GPT-2 Small
• load SAE artifacts
• fetch or download weights
• generate artifact digest locks
• emit real storage receipts
• bypass policy/grant/storage/evidence gates
• close Implement controlled activation for local steering inference provider #34

The new steer serve --sourceset path remains fail-closed and returns status: not_configured until runtime dependencies, verified artifacts, storage receipts, policy/grant admission, activation injection, and local smoke evidence are present.

Validation

Native CI passed on this PR head:

• validate run #164: passed
• Trust Surface run Add SourceOS projection fixtures for Agent Machine receipts #21: passed

The validate path exercised steer preflight --sourceset gpt2-small.res-jb through both Python and bootstrap CLI paths.