MC-4765

Completed MC visibility-only cutover after user asked to finish the previously tool-limit-stopped work. Implemented: - MC defaults to visibility-only mode. - Mutating runtime/session endpoints now return visibility-only 403s instead of starting/sending/harvesting/switching/retrying runtimes. - implement_now creates a todo ticket/comment trail but does not start a runtime. - direct ticket claim endpoint is blocked in visibility-only mode. - Control Room event hooks are disabled by visibility-only mode even if hook flag is set, so they cannot send prompts into persistent_luci. - Control Room pickup, shadow review, and review retry paths no-op under visibility-only. - Runtime Workbench/dashboard/ticket UI hides or guards runtime controls and explains the cutover. - Canonical runtime architecture doc updated. Verification: - `python3 -m pytest tests/test_visibility_only_mode.py tests/test_visibility_only_control_room_pickup.py tests/test_ticket_pickup_regressions.py tests/test_mc4207_shadow_review.py tests/test_mc4291_review_retry.py -q` => 72 passed. - `python3 -m compileall app.py control_room_events.py mc_shadow_review.py mc_review_retry.py scripts/control_room_pickup.py tests/test_visibility_only_mode.py tests/test_visibility_only_control_room_pickup.py` => passed. - Static added-line secret/danger scan => no matches. - Independent re-review => passed; no blockers. - `graphify update .` => graph metadata refreshed. - Service restart verified active. - Live smoke: `/api/v1/tickets/4735/claim`, `/api/v1/session_start` plan, and `/api/v1/persistent_luci/start` all returned visibility-only 403 responses. Commit pushed: 4ea5907 fix: enforce MC visibility-only runtime guards Human link: http://100.118.207.3:3001/