refactor: extract services layer, Result type, and ErrorCode classification

- Add DI container (src/services/) with AgentExecutionService, ConfigLoaderService, and ExploitationCheckerService — pure domain logic with no Temporal dependencies
- Introduce Result<T, E> type and ErrorCode enum for code-based error classification in classifyErrorForTemporal, replacing scattered string matching
- Consolidate billing/spending cap detection into utils/billing-detection.ts with shared pattern lists across message-handlers, claude-executor, and error-handling
- Extract LogStream abstraction for append-only logging with backpressure, used by both AgentLogger and WorkflowLogger
- Simplify activities.ts from inline lifecycle logic to thin wrappers delegating to services, with heartbeat and error classification
- Expand config-parser with human-readable AJV errors, security validation, and rule type-specific checks

src/temporal/shared.ts

@@ -1,5 +1,9 @@
 import { defineQuery } from '@temporalio/workflow';
 
+// Re-export AgentMetrics from central types location
+export type { AgentMetrics } from '../types/metrics.js';
+import type { AgentMetrics } from '../types/metrics.js';
+
 // === Types ===
 
 export interface PipelineInput {
@@ -22,15 +26,6 @@ export interface ResumeState {
   originalWorkflowId: string;
 }
 
-export interface AgentMetrics {
-  durationMs: number;
-  inputTokens: number | null;
-  outputTokens: number | null;
-  costUsd: number | null;
-  numTurns: number | null;
-  model?: string | undefined;
-}
-
 export interface PipelineSummary {
   totalCostUsd: number;
   totalDurationMs: number; // Wall-clock time (end - start)