feat(config)!: reject obsolete Run configuration forms

[LukeMathWalker]

Why

OpenFirma is alpha and exposes one strict current Run configuration contract. Flat capability source fields and the codex_cli policy alias are obsolete alternate representations; accepting them through runtime or firma config would leave multiple meanings for the same settings.

What changed

• Retain only tagged capability.source; reject flat capability.kind / capability.path in defaults and every named profile.
• Retain only keyed executable_policies.codex; reject codex_cli in all profile shapes.
• Remove compatibility-only schema fields, runtime merge/fallback/path-rebase branches, helpers, fixtures, and generated/public syntax.
• Prove firma config reaches its existing complete typed-validation boundary and fails before any write for standard, inline, selected, unselected, malformed, and mixed old/current forms.
• Preserve canonical PR feat(config)!: make Run profile merging deterministic #613 layering, path rebasing, generated defaults, CLI precedence, and runtime behavior.
• Use current identity terminology when a profile value is incorrectly placed in [sidecar.authority].agent_id.

Breaking contract

Removed forms are rejected rather than migrated, aliased, or ignored. Use tagged capability.source and keyed executable_policies.codex. Failed firma config validation leaves existing scaffold files byte-identical.

Atomic revisions

1. cb7ec616 — accepted plan and independent plan-review dispositions.
2. 227b4d52 — reject flat capability sources across schema, runtime, CLI scaffolding, tests, and current docs.
3. 0fe1d9de — reject codex_cli across the same owned boundaries.
4. 67b7b1ac — use current Run identity terminology.
5. e80c6a27 — record the independent implementation review and its mechanical-plan finding.
6. 7d8e5f83 — immediately remove the plan artifact.

Plan and independent review

• Accepted plan and unchanged plan-review findings: cb7ec616: remove-legacy-run-config-plan.md.
• Independent implementation review and disposition: e80c6a27. No code finding survived; the expected plan-presence finding is resolved by the immediate child.
• Mechanical plan removal: 7d8e5f83. No plan Markdown remains at the tip or in the PR diff.