[codex] Add agent-driven Summon broker

[nahiyankhan]

Summary

• Add an agent-driven Summon broker that plans bounded surface policies from prompts.
• Wire the demo server generate route to accept agent.enabled, emit broker diagnostics, and hand the compiled policy into normal generation.
• Tighten broker inference so prompt wording can narrow to known host capabilities/components without widening authority, with docs and package-export updates.

Impact

Agent callers can ask Summon to infer a host-owned surface config from a prompt while staying inside the provided capability/component catalog and host policy resolver limits.

Validation

• pnpm test
• pnpm typecheck