feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

profiles/profile.build.yaml

@@ -0,0 +1,35 @@
+id: profile.build
+version: "1.0.0"
+extension: ext.vm-packer
+isolation:
+  level: microvm
+network:
+  default: deny
+  egress: []
+workspace:
+  mode: remote-canonical
+  access: rw
+scope_default: agent
+ttl:
+  default: 8h
+  max: 24h
+  idle_reap: null
+resources:
+  cpu: null
+  memory_mb: null
+setup:
+  instructions: >
+    Build sandbox for snuggle-inventor. Attach to pre-built VM via ops-bridge
+    tunnel (e.g. haskell-build). Secret refs resolved at provision boundary only.
+  secret_refs:
+    - build-registry-token
+placement:
+  prefer: [localhost]
+  fallback: [workstation]
+reachability:
+  tunnel: ops-bridge
+  identity: ops-warden
+metadata:
+  cost_class: self-hosted
+  latency_class: standard
+  observability: none