feat(agent): ship the Go agent canvas port — eino interrupt/resume + Redis check-pointing (#16035)

Replaces the Python agent canvas runtime with a Go implementation that
runs inside `cmd/server_main`.

The canvas compiles into an eino Workflow that pauses on wait-for-user
via native Interrupt/Resume (no sentinel flag) and resumes from a
Redis-backed CheckPointStore.

All 21 Python agent components and ~35 tools are ported with functional
parity.

Sandbox providers now read their JSON config from the admin-panel
system_settings table with env fallback.

234 files / +35,413 / -6,111. All Go files are gofmt-clean (CI gate
added); drops the v2 DSL E2E step and the gap-analysis plan (both
redundant after the port ships).

## Type of change

- [x] Refactoring
- [x] New feature
- [x] Bug fix

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude <noreply@anthropic.com>

test/testcases/restful_api/test_agents.py

@@ -139,8 +139,11 @@ def test_agents_crud_validation_contract(rest_client, create_agent_resource):
     invalid_delete = rest_client.delete("/agents/invalid-agent-id")
     assert invalid_delete.status_code == 200
     invalid_delete_payload = invalid_delete.json()
+    # code=103 = permission denied (Python: "Only the owner of the agent..."; Go: "Make sure you have permission...")
     assert invalid_delete_payload["code"] == 103, invalid_delete_payload
-    assert "Only the owner of the agent is authorized for this operation." in invalid_delete_payload["message"], invalid_delete_payload
+    msg = invalid_delete_payload["message"]
+    assert ("Only the owner of the agent is authorized" in msg
+            or "Make sure you have permission" in msg), invalid_delete_payload
 
     delete_res = rest_client.delete(f"/agents/{agent_id}")
     assert delete_res.status_code == 200