Implement managed app metrics in the runtime

Implement the runtime half of RFD-110 end to end.

Add the opt-in service metrics configuration and default-private ingress behavior. When the cluster has a remote-write destination, run one supervised vmagent on the coordinator, maintain targets for every eligible sandbox, scrape them over the private overlay, attach canonical workload labels, enforce cluster safety limits, and authenticate export with a rotating workload-identity token.

Do not start vmagent without a destination, and do not mirror application metrics into the embedded VictoriaMetrics yet.

Done when a multi-replica test app exports distinct per-sandbox samples to an authenticated remote-write destination and its metrics path remains private by default.