refactor(gateway): extract config/runtime-resolution helpers from run.py (slice 12 of #54962)

[andrexibiza]

Related #54962 #55138 #77702 #77704 #77706 #77707 #77708

What

Twelfth slice of the gateway/run.py large-file decomposition (#54962): extract the config/runtime-resolution cluster into a new gateway/config_helpers.py module — pure move, zero behavior change, zero refactor.

Moved (verbatim, byte-identical to HEAD):

• _profile_runtime_scope — profile-runtime scoping (config/skills/memory + credentials) for the multiplexer
• load_gateway_config_for_runner — process-level config load for the runner (multiplex-aware)
• _OWN_POLICY_OPEN_ENV + _own_policy_open_startup_violation — open-policy allow-all startup validation
• _resolve_runtime_agent_kwargs_for_provider — per-provider runtime credential resolution
• _credential_pool_for_provider — live credential-pool lookup

gateway/run.py now imports these names back from the new module (module-attribute import, in place of the first moved block), so every existing gateway.run.<name> reference — production modules, plugins, and tests — stays green. The new module never imports gateway.run (no circularity).

Stayed in gateway/run.py (honest scope note):

• _current_max_iterations — its reload helper _reload_runtime_env_preserving_config_authority reads _hermes_home module state that 20+ test files monkeypatch via gateway.run._hermes_home; moving it would silently break that contract.
• _resolve_runtime_agent_kwargs / _try_resolve_fallback_provider — the fallback chain calls _load_gateway_runtime_config, which builds on the _load_gateway_config hub (17+ call sites) that stays in gateway/run.py. These move in a later slice together with the hub.

Also removed the now-dead from contextlib import contextmanager as _contextmanager alias (its only consumer moved).

Why

gateway/run.py is a 26.8k-line god file; AGENTS.md explicitly blesses extracting clusters into focused modules. This slice is one of the parallel extraction PRs tracked in #54962 (gate 3) and #55138, following the verified pattern from slices 1–11 (e.g. #77708, #77707, #77706, #77704, #77702).

Shrink

• gateway/run.py: 26,823 → 26,677 lines (−146 net; −155/+9)
• gateway/config_helpers.py: +188 lines (new)

How to test

python -c "import gateway.run"   # import smoke test
git diff --check                 # whitespace clean
python scripts/check-windows-footguns.py gateway/run.py gateway/config_helpers.py

Targeted suites (all referencing the moved names):

python -m pytest tests/gateway/test_64674_multiplex_primary_token_scope.py \
  tests/gateway/test_75349_whatsapp_multiplex_secret_scope.py \
  tests/gateway/test_email_secret_scope.py tests/gateway/test_profile_resolution.py \
  tests/gateway/test_qqbot_scope_paths.py tests/gateway/test_multiplex_profile_authz.py \
  tests/gateway/test_session_model_override_credential_pool.py \
  tests/gateway/test_api_server.py tests/gateway/test_channel_overrides.py \
  tests/gateway/test_session_api.py tests/gateway/test_session_model_override_persistence.py \
  tests/gateway/test_model_picker_persist.py tests/gateway/test_multiplex_adapter_registry.py \
  tests/gateway/test_multiplex_background_task_scope.py \
  tests/gateway/test_multiplex_credential_isolation.py \
  tests/gateway/test_runtime_env_reload_config_authority.py \
  tests/gateway/test_cjk_fts_config_bridge.py

Result: 187 passed, 1 xfailed, 1 failed (test_health_detailed_returns_ok — pre-existing env failure, stash-proven identical on clean main).

Platforms tested

• Windows native (git-bash, main-checkout venv, worktree as cwd)

Part of #54962
Part of #55138

Part of #78207
Part of #78647