Enable chat runtime for Codex and Antigravity on MicroVM

Operator ask (task 9869): "close the gap". On MicroVM nodes, Codex API-key sessions and all Google Antigravity sessions fall back to the legacy terminal runtime. Chat (ACP) is the product standard: readable, works on a phone, has question cards, and is the same for every agent. These runs must use chat on MicroVM too. Why they fall back today: chat-mode launches read the login from the account's home folder on the host (Codex `codex login --with-api-key` into the host CODEX_HOME; Antigravity GEMINI_HOME / `acp_token.json` / host-written hooks). A MicroVM guest has no host home, so the catalogue gaps `microvm-api-key-legacy-runtime` (Codex) and `microvm-legacy-runtime` (Antigravity) and `apps/api/app/acp_runtime.py::microvm_runtime` force legacy, and the legacy path puts the API key in the guest environment. The attached recon has file:line detail and a proposed approach: in the guest, fetch the key over the existing guest creds socket (vsock) and run the login into a guest-local home, mirroring how `acp/host.py` already fetches keys. Requirements: - Codex API-key sessions on a MicroVM node run ACP (chat), with no API key in the guest's process environment. - Antigravity sessions (API key and subscription) on a MicroVM node run ACP. If one auth kind is infeasible, deliver the other and state why in the PR. - Remove the catalogue gaps and the CP `microvm_runtime` clauses that no longer apply. Update `apps/jaahd/README.md` and `docs/policies/microvm-nodes.md` in place. - The credential served to a guest must be that VM's own session account only (verify the VmCaller → account binding in cred_broker). This is a credential-handling change: run the full autonomous security review lane. Out of scope: Claude subscription (terminal by licence, operator decision A5); the console's Chat | Terminal UI; the backend hand-off route. Done means: - On a live MicroVM node, a Codex API-key task's Agent tab shows "Session start · ACP" and the console opens in Chat. Screenshot it. - Same for an Antigravity task (each auth kind delivered). - A test proves no API key is in the guest launch environment for these runs. - `./dc check quick` green; PR merged via the merge lane; Jaah Deploy succeeds.

MicroVM Codex + Antigravity API-key runs now use ACP (host signs in with the VM's own key; no key in guest env). Antigravity signed-in stays legacy (host-seeded token). Quick gate green, review lane pass, #6859 merged, Jaah Deploy green. Live MicroVM screenshots not taken: dev MicroVM node behind release, no Codex API-key account. Memory: none applied.