refactor(cleanup): remove legacy runtime directories and fix API semantics

Task 1: Clean up root-level runtime directories
- Backup live/, backtest/, production/ to runs/_legacy/
- Remove legacy directories from repo root

Task 2: API route semantics cleanup
- Create /api/runs/{run_id}/agents/* routes for runtime agent operations
- Keep /api/workspaces/{id}/agents/* for design-time (deprecated)
- Update frontend runtimeApi.js to use new /runs/ prefix
- Update legacy-inventory.md with completion status

New files:
- backend/api/runs.py - Runtime agent routes with proper run_id semantics

Modified:
- backend/api/__init__.py - Export runs_router
- backend/apps/agent_service.py - Include runs_router, update scope docs
- frontend/src/services/runtimeApi.js - Use /runs/ instead of /workspaces/
- docs/legacy-inventory.md - Mark cleanup as completed

Constraint: Maintain backward compatibility with old /workspaces/ routes
Rejected: Remove old routes entirely | need backward compatibility during transition
Confidence: high
Scope-risk: moderate
Directive: Old /api/workspaces/ routes remain functional but deprecated
Not-tested: Full integration test with active runtime

frontend/src/services/runtimeApi.js

@@ -130,12 +130,12 @@ export function fetchRuntimeLogs() {
 }
 
 function buildRunScopedAgentPath(runId, agentId, suffix = '') {
-  return `/workspaces/${encodeURIComponent(runId)}/agents/${encodeURIComponent(agentId)}${suffix}`;
+  return `/runs/${encodeURIComponent(runId)}/agents/${encodeURIComponent(agentId)}${suffix}`;
 }
 
 /**
- * Runtime-read agent routes still use the `/workspaces/...` prefix on the
- * backend, but the leading identifier on this surface is the active `run_id`.
+ * Runtime agent routes use `/runs/{run_id}/agents/...`.
+ * Legacy `/workspaces/...` routes are deprecated but remain for backward compatibility.
  */
 export function fetchAgentProfile(runId, agentId) {
   return safeFetch(CONTROL_API_BASE, buildRunScopedAgentPath(runId, agentId, '/profile'));