Renew this runtime's own agent JWT before it expires

Called by the runtime container itself, not by a human or an external client. A runtime's ONECLAW_AGENT_TOKEN is a short-lived JWT that Cloud Run resolves from Secret Manager when the instance starts and never again, so a container that outlives the TTL loses its credential — and with it every 1claw tool — until it is restarted. This lets it replace the token in place instead. Authenticated by the credential being renewed: the caller must present a still-valid runtime-bound agent JWT together with a matching X-1Claw-Runtime-Id header, and must be the agent that runtime is bound to. It grants nothing new — the same claims with a later expiry — and stops working the moment the token lapses, the token is revoked, the agent is suspended, or the runtime is no longer deployed. Exempt from the monthly request quota: upkeep of an already-paid-for runtime is not itself a billable request.