feat: allow cloud AI agent profile

[1aal]

Summary:

• make cloud-ai-agent the Runtime API session default profile
• keep global-entry and cluster-diagnosis in the allowed profile set for compatibility
• add session API coverage for default cloud-ai-agent binding and profile lock rejection

Tests:

• .venv/bin/pytest tests/gateway/test_session_api.py
• git diff --check

Related:

• supports apecloud PR refactor(cli): drop dead c-S-c key binding (follow-up to #19895) NousResearch/hermes-agent#19919 unified cloud AI agent profile wiring