feat(profile): add immutable intake snapshot

[drewstone]

Summary

• add the canonical snapshotAgentProfile boundary function
• copy untrusted input once, then apply the existing schema and portable-data contract before recursively freezing it
• preserve explicit values without adding defaults, model/provider choices, roles, or execution policy
• reject mutable non-portable values instead of wrapping them with new behavior

Release consequence

The minor changeset releases @tangle-network/agent-interface as 0.40.0. Consumers with a <0.40 peer range must widen it; the materializer cohort is being updated to >=0.38 <0.41.

Verification

• pnpm check-types
• pnpm test — 702/702 tests passed across 8 packages
• pnpm build
• pnpm check:package-artifacts — 8 packages, 18 exports, 36 export targets
• pnpm --filter @tangle-network/agent-interface pack — snapshot JS and declarations present
• packed-root smoke — export callable, source detached, root and nested values frozen
• critical audit — 0 findings across 3 review lenses
• git merge-tree --write-tree origin/main HEAD — clean