feat(cli): show the runtime tier and egress posture per session

[rigel-mintaka]

This PR is part of a stack containing 10 PRs:

1. main
2. feat(runtime): add the host-process WorkloadRuntime backend (RIG-3512) #1120
3. feat(runner): derive the agent uid from the Runner's euid on the host backend (RIG-3512) #1125
4. feat(runner): deliver the agent socket and config by path on the host backend (RIG-3512) #1135
5. feat(runtime): distinguish a configured egress policy from an unset one #1142
6. feat(runtime): refuse an egress policy the host tier cannot enforce #1143
7. feat(runner): carry no egress policy on a backend that cannot enforce one #1145
8. feat(runner): report the runtime tier and egress posture per session #1148
9. "feat(cli): show the runtime tier and egress posture per session" (this PR)
10. feat(ui): mark each agent's runtime tier and egress posture #1154
11. feat(runner): declare the runtime tier and egress posture at enrollment #1156

The agent status listing printed session and state only, so an operator could
not tell which isolation boundary an agent got — or that a host-tier session has
none. Two columns added.

The tier renders as the token --backend accepts, so a tier a reader sees is one
they can select; an unknown tier or posture renders as unspecified rather than a
plausible default, because reading an unknown posture as armed would show an
uncontained session as contained.

[linear-code]

RIG-3512

[github-actions]

Compass engineering docs preview: https://compass-service-owner-rig-35-9f87.compass-eng-docs.pages.dev

Deployed from compass-service-owner/rig-3512-cli-posture-column at 8b5ee31.

[trunk-io]

This pull request was merged into main as part of stacked PR 1156.