FND-RT repair: enforce integration registry validation

[skylarbpayne]

Summary

• enforce the FND-RT service ID and contract-version contract at WorkflowEngine.resolve_runtime_service
• preserve accepted integration-owned registry identity and delegation behavior
• add the four hostile regression cases from the retroactive audit

Scope

• bounded repair for FND-RT only
• no live registry, database, profile, worker, service, reconfiguration, or cutover mutations
• .hermes/showcase-artifacts untouched
• PR feat: support custom select values in review queue #131 excluded

Verification

• TDD red: 4 expected failures before the engine-boundary validation fix
• uv run pytest -q tests/test_runtime_services_contract.py tests/test_engine.py tests/test_runner_v2_recovery.py tests/test_types.py — 57 passed
• uv run pytest -q — 600 passed, 1 skipped
• git diff --check — clean
• changed-path allowlist — clean

Review gate

Do not merge without review.