Harden Gateway runtime identity boundaries

[madtank]

Summary

• reject user bootstrap PATs on Gateway-managed runtime/send paths
• require managed runtime entries to have a bound agent_id before token use
• isolate Gateway local state by AX_GATEWAY_ENV, with AX_GATEWAY_DIR override for explicit deployments
• document environment-specific Gateway state and agent-bound runtime token requirements

Verification

• uv run ruff check ax_cli/
• uv run ruff format --check ax_cli/
• uv run pytest -q tests/test_gateway_commands.py
• uv run pytest -q