fix(portal): lock profile-managed run resources - #1632

Summary

• move Resources into the /runs/new agent/runtime integration area beside MCP Servers and Skills
• lock profile-managed resource bindings, revisions, and preset parameter values while preserving editable parameter gaps allowed by the single-profile API contract
• keep resources fully editable when the selected profile does not declare resource bindings
• add focused regression coverage, ResourcePicker Storybook states, and architecture documentation

Relates to #1626.

PR stack

1. fix: isolate profile variation submissions #1631 — Profile variation isolation
2. fix(portal): lock profile-managed run resources #1632 — Profile-managed Resources UI (this PR)

This PR targets #1631's upstream branch, cedricvidal-fix-multi-profile-submission; #1631 must merge first.

Demos

Before

N/A — no recording attached.

After

Headless walkthrough showing resource placement, profile-managed locks, editable run-owned parameter gaps, and profiles without resource bindings:

Testing

• Passed: pnpm exec vitest run apps/portal/src/pages/SubmitRun.variations.test.tsx apps/portal/src/components/ResourcePicker.test.tsx --reporter=default (2 files, 4 tests)
• Passed: pnpm --filter portal build
• Passed: pnpm --filter portal build-storybook --quiet
• Passed: authenticated Playwright smoke test against the Compose stack covering runtime placement, profile-owned binding/revision/preset locks, editable run-owned parameter gaps, and profiles without resource bindings
• Passed: headless 1440×900 walkthrough playback verification (H.264, yuv420p, 25.44 seconds)

Documentation and compatibility

• Updated docs/architecture/resources.md with the run-wizard location and profile/run ownership behavior.
• No API contract, CLI behavior, database schema, migration, dependency, or upgrade changes.

Checklist

• If Portal features changed, keep CLI capabilities in sync. (N/A — this UI enforcement reflects the existing API/CLI contract.)
• If Portal components changed, update their Storybook stories.
• If database changes require a migration, include up() / down() and keep it CosmosDB-compatible. (N/A — no database changes.)
• If dependencies changed, update the lockfile and regenerate NOTICE / NOTICE-REVIEW.txt with pnpm notice as needed. (N/A — no dependency changes.)
• Video showing the behavior before the suggested change
• Video showing the behavior after the suggested change