feat(compile): add Node.js runtime extension with optional internal-feed config

[Copilot]

Summary

Implements a Node.js runtime extension for the runtimes: node: front-matter field, following the same pattern as the existing Lean 4 runtime.

What it does

When runtimes: node: is enabled in an agent's front matter, the compiler:

1. Injects a NodeTool@0 step into {{ prepare_steps }} (runs before the agent), using the shared node_tool_step() helper introduced in feat(compile): runtime prompt injection via prompt.js bundle #395. NodeTool@0 is idempotent, so it is safe even when prompt.js also emits the step.
2. Adds node, npm, npx to the bash command allow-list.
3. Adds the "node" ecosystem to the AWF network allowlist (expands to registry.npmjs.org, nodejs.org, etc.).
4. Appends a prompt supplement informing the agent that Node.js is available.
5. Emits a warning if tools.bash is empty (Node.js requires bash access).

With optional internal-feed configuration, an additional bash step is injected that runs npm config set registry to redirect npm commands to a private registry (e.g., Azure Artifacts). When auth-token-var is also set, the step configures the per-registry _authToken using a value read from a pipeline variable at runtime — it is never embedded in the compiled YAML.

Usage

# Simple enablement (installs Node.js 20.x LTS)
runtimes:
  node: true

# Pin to a specific LTS major version
runtimes:
  node:
    version: "22.x"

# With an internal npm feed (Azure Artifacts)
runtimes:
  node:
    version: "20.x"
    internal-feed:
      registry: "https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/FEED/npm/registry/"
      auth-token-var: "SC_READ_TOKEN"

Files changed

• src/compile/extensions/mod.rs — node_tool_step() now accepts a version_spec: &str parameter; updated two existing callers to pass "20.x" explicitly.
• src/runtimes/node/mod.rs (new) — NodeRuntimeConfig, NodeOptions, NodeInternalFeedConfig, NODE_BASH_COMMANDS, generate_node_install(), generate_node_feed_config().
• src/runtimes/node/extension.rs (new) — NodeExtension implementing CompilerExtension.
• src/runtimes/mod.rs — added pub mod node;.
• src/compile/types.rs — added node field to RuntimesConfig; updated sanitize_config_fields.
• src/compile/extensions/mod.rs — re-exported NodeExtension; added Node(NodeExtension) to Extension enum; wired collect_extensions.
• docs/runtimes.md — documented runtimes.node with examples and an internal-feed option table.
• AGENTS.md — added node/ to the source tree overview.

Tests

• cargo build ✓
• cargo test — 1117 + 78 + others pass; no regressions
• cargo clippy --all-targets --all-features — clean