Scope Island activity state to TenantRuntime

[oratis]

Summary

• add an explicit per-runtime activity state for recent user activity, unread idle messages, advisor cache, and idle/reflection coordination
• initialize that state independently for every tenant runtime and the local global runtime
• make Island ping select desire focus from the current tenant's history and activity timestamp
• make unread dismiss/latest reads operate through a pinned current TenantRuntime
• keep cross-machine Advisor suggestions operator-owned in the local global runtime
• deny /api/advisor/* in the cloud capability boundary so hosted tenants cannot read or mutate operator Advisor state
• move global idle/reflection scheduler flags and reflection watermarks under the explicit local runtime owner

Dependency

Stacked on #320; full merge order is #317 → #318 → #319 → #320 → this PR.

Validation

• npm run typecheck
• focused TenantRuntime/capability/event-bus tests — 21 passed
• npm test — 1462 passed, 1 skipped, 0 failed
• npm run build