P2: run.Executor — executus is runnable

The capstone of the run kernel: run.Executor.Run(ctx, RunnableAgent, inv)
ties model resolution + the tool registry + majordomo's agent loop +
context compaction + run-bounding + step/audit instrumentation into one
path, with every host concern behind the nil-safe run.Ports.

- run/executor.go: New(Config{Registry, Models, Defaults, Ports, Compactor,
  ContextTokens, SystemHeader}) + Run -> Result{RunID, Output, Steps, Usage,
  Err}. Budget gate (pre-run), model resolve, Audit StartRun/recorder
  (satisfies RunTally, stamped on inv.RunState), toolbox build, step observer
  (zips tool calls/results -> emitter + recorder.OnStep/OnTool), V10
  detached-MaxRuntime context with caller-cancel merged back, compaction wired
  from ContextTokens×ratio, audit Close + Budget Commit on a detached cleanup
  ctx. Zero Ports = a bounded in-memory run (gadfly's case).
- run/executor_test.go: hermetic end-to-end run against majordomo's fake
  provider (hello-world), Budget-rejection (no model call), Audit-port wiring
  (StartRun + Close with terminal status/output). All green under -race.
- examples/minimal upgraded to the real "hello, agentic world" (~15 lines:
  Configure tiers -> run.New -> Run -> print). README/CLAUDE.md updated.

Remaining P2 follow-ups (incremental): wire Critic/Checkpointer/PaletteSource/
Delivery into the loop, multi-phase Pipelines, and the no-tools direct path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -31,15 +31,23 @@ bot) — mort and gadfly are the first two consumers (heavy and light). See
 
 [mort]: https://gitea.stevedudenhoeffer.com/steve/mort
 
-**Available today (P0):**
+**Available today:**
 
+- `run/` — **executus is runnable.** `run.Executor` ties model resolution, the
+  tool registry, majordomo's agent loop, context compaction, run-bounding, and
+  step/audit instrumentation into one `Run(ctx, RunnableAgent, inv) Result`, with
+  every host concern behind a nil-safe `run.Ports` (Audit/Budget/Critic/
+  Checkpointer/PaletteSource/Delivery). See `examples/minimal`.
+- `model/` — config-driven tier resolution + failover over majordomo, with
+  pluggable `UsageSink`/`TraceSink` and `GenerateWith[T]` structured output.
+- `tool/` — the tool registry + 3-stage permission model + SSRF guard.
+- `compact/` — the per-run context compactor.
 - `lane/` — bounded worker pool with fair-share queueing (run- and
   provider-concurrency).
 - `fanout/` — programmatic N×M swarm with bounded global + per-key concurrency.
-- `config/` — the host config seam (`Source`) with an env-var default.
-- `deliver/` — the output-egress seam with `Discard`/`Stdout` defaults.
-- `identity/` — caller-identity seams (`AdminPolicy`, `MemberResolver`).
-- `dispatchguard/`, `pendingattach/`, `run/progress.go` — run-safety primitives.
+- `config/`, `deliver/`, `identity/` — host seams (config / output / identity),
+  each with a shipped default.
+- `dispatchguard/`, `pendingattach/` — run-safety primitives.
 
 ## Design