feat(publish): preserve application runtime config in packs

[wolfy-j]

Summary

• add an application-only publish.runtime.sections allow-list that copies declared base runtime sections from a source .wippy.yaml into pack metadata
• publish only variables referenced by selected sections or published profiles, following references transitively; unreferenced variables are excluded by default
• add publish.runtime.vars as an explicit allow-list for intentionally public defaults that are not otherwise referenced
• derive metadata from unresolved source so publisher environment values are never expanded, reject ${env:...} in exported configuration, and categorically reject machine-local boot, extensions, and workspace sections
• make the main application pack the sole authority for host runtime defaults; dependency packs cannot configure the host
• preserve exact scalar types for nested runtime metadata while retaining legacy coercion for dotted runtime.* metadata

Runtime precedence

Lowest to highest:

1. main application pack defaults
2. runtime built-in defaults
3. destination-local config files, in declared order
4. selected profiles
5. CLI/runtime overrides

Dependency-pack runtime metadata is ignored.

Application manifest

Applications opt in without duplicating values:

type: application
publish:
  runtime:
    source: .wippy.yaml
    sections:
      - security
      - registry
      - override
    vars:
      - public_url

source defaults to .wippy.yaml. Referenced variables do not need to be listed in vars; that list is only for deliberately public, otherwise-unreferenced defaults. Literal credentials and other unrelated variables stay out of the pack. Runtime publication is rejected for library, agent, and plugin packages.

Validation

• targeted config, profile, CLI, and pack round-trip tests
• race detector on boot/deps/config, cmd/internal/bootconfig, and cmd/wippy/cmd
• go vet on the affected packages
• complete go test ./... -count=1: all affected packages passed; the run hit the pre-existing service/exec/native output-capture flakes in MegaCommand and Stderr
• both flaky native tests then passed 20/20 isolated repetitions

The PR remains open for application-level retesting and is not approved for merge yet.