Make admin runtime editing scope-aware

[time-attack]

Summary

• move the runtime override card from org-wide Models to scoped Governance and show the exact target being edited
• preserve scope across refresh and browser history while retaining stale-load, stale-write, and in-flight guards
• disable retained-but-unapproved harnesses and retained-but-unserviceable models without losing reset or valid-choice recovery
• expose durable approval and server-computed availability through the existing scope response, keeping authorization and validation unchanged

Fixes #589.

Test plan

• admin UI/proxy/auth suites: 144 passed
• core authorization/resolution/catalog suites: 113 passed
• full-page Chromium suite against a local synthetic API: 6 passed
• independent manual browser QA: scoped target, refresh, Models isolation, Back restoration, and successful scoped runtime PUT
• root/admin typechecks, repository ESLint, Oxlint, Knip, targeted Prettier, and git diff --check

Coverage includes channel, project, personal, team, and organization scopes; inheritance reset; stale approvals; alternative/custom/empty catalogs; and authorization negatives.