feat: add runtime trust diagnostics

[rogerchappel]

Summary

• add a pure runtime trust summary helper for runtime readiness signals
• expose additive trustSummary data from the read-only runtimes API
• cover healthy, degraded, and untrusted classifications with focused tests

Verification

• git diff --check
• pnpm test src/lib/runtime-trust.test.ts
• pnpm exec eslint src/lib/runtime-trust.ts src/lib/runtime-trust.test.ts src/app/api/runtimes/route.ts
• pnpm exec tsc --noEmit --pretty false
• push hook: pnpm typecheck && pnpm build

Risk

Low. This is additive read-only response data and does not change runtime routing, config writes, schema, or session persistence.