feat(agent): complete EvoAgent integration for all 6 agent roles

Migrate all agent roles from Legacy to EvoAgent architecture:
- fundamentals_analyst, technical_analyst, sentiment_analyst, valuation_analyst
- risk_manager, portfolio_manager

Key changes:
- EvoAgent now supports Portfolio Manager compatibility methods (_make_decision,
  get_decisions, get_portfolio_state, load_portfolio_state, update_portfolio)
- Add UnifiedAgentFactory for centralized agent creation
- ToolGuard with batch approval API and WebSocket broadcast
- Legacy agents marked deprecated (AnalystAgent, RiskAgent, PMAgent)
- Remove backend/agents/compat.py migration shim
- Add run_id alongside workspace_id for semantic clarity
- Complete integration test coverage (13 tests)
- All smoke tests passing for 6 agent roles

Constraint: Must maintain backward compatibility with existing run configs
Constraint: Memory support must work with EvoAgent (no fallback to Legacy)
Rejected: Separate PM implementation for EvoAgent | unified approach cleaner
Confidence: high
Scope-risk: broad
Directive: EVO_AGENT_IDS env var still respected but defaults to all roles
Not-tested: Kubernetes sandbox mode for skill execution

docs/terminology.md

@@ -0,0 +1,79 @@
+# Terminology
+
+Use these terms consistently when changing code, docs, or UI.
+
+## Core Terms
+
+### `design-time`
+
+Use for configuration, editing, and control-plane concepts that exist before a
+specific runtime is launched.
+
+Typical examples:
+
+- `workspaces/`
+- workspace registry CRUD
+- design-time agent metadata
+
+### `runtime`
+
+Use for the active execution layer and its state.
+
+Typical examples:
+
+- runtime lifecycle APIs
+- scheduler / gateway execution
+- approvals during a live run
+- runtime snapshots and logs
+
+### `run`
+
+Use for one concrete execution instance.
+
+Typical examples:
+
+- `runs/<run_id>/`
+- runtime history
+- run logs
+- run bootstrap config
+- run-scoped agent assets
+
+### `workspace`
+
+Prefer this word only for the design-time registry unless you are working on a
+historical compatibility surface that still uses the old path or field name.
+
+Examples:
+
+- good: "design workspace"
+- good: "workspace registry"
+- avoid for new runtime UI: "current workspace" when you really mean current run
+
+## Compatibility Rule
+
+Some API paths and fields still use legacy names:
+
+- `/api/workspaces/{workspace_id}/agents/...`
+- `workspace_id` on approval records
+
+When reading those surfaces:
+
+- design-time CRUD routes use `workspace_id` literally
+- runtime-read routes may use the same slot for `run_id`
+
+For new code:
+
+- prefer `runId` for runtime variables
+- prefer `workspaceId` only for design-time registry flows
+
+## UI Wording
+
+For operator-facing runtime UI, prefer:
+
+- "运行任务"
+- "运行文件"
+- "运行资产"
+- "任务 ID"
+
+Avoid using "工作区" for active runtime concepts unless the screen is truly
+about the design-time workspace registry.