Vendor the past-HEAD intx packages step 1 needs, with ledger

[TheGreatAxios]

Summary

• Stacked on the seven-package vendor branch (e1ea87a9). Makes the vendoring Step 1 deliberate and dated: npm verified first, published deps preferred, one pin for every tree, and a provenance row with owner + proposed kill date for every vendored path.
• npm verification (done first, on 2026-09-07): @intx/mailbox — registry 404 for all versions, never published → vendor whole package; @intx/hub-sessions ./substrate — 0.3.0 published and re-exports createAgentRepoStore with dataDir + signingKey (tarball inspected) → published dep 0.3.0; workflow-host substrate-mailbox-store — @intx/workflow-host 0.3.0 published but dist/adapters lacks substrate-mailbox-store (tarball inspected) → vendor as partial-package source dir; @intx/mail-memory — 0.3.0 published with both needed exports (tarball inspected) → published dep 0.3.0; @intx/harness reply-drain — 0.3.0 published but reply-drain absent from dist (tarball inspected) → vendor whole package; @intx/workflow onEvent seam — the seam lives in @intx/workflow-host, and published 0.3.0 dist/adapters/step-invoker carries it → published dep @intx/workflow-host 0.3.0.
• Vendored, all at pin 0205b07b64d03f0fec2e4be3593c764070a9ba8a (one pin, no mixing): vendor/intx-mailbox (verbatim, 0.2.2 overlay), vendor/intx-harness (verbatim, 0.2.2 overlay, carries reply-drain.ts), vendor/intx-mime (verbatim, 0.2.2 overlay — not in the original six: published @intx/mime@0.3.0 lacks buildMessageHeaders, which vendored mailbox re-exports, so published mime does not cover the need; vendored per the prefer-published-else-vendor rule and intx-agent's mime dep moved to workspace:* under a new root override), and vendor/intx-workflow-host/adapters/substrate-mailbox-store.{ts,test.ts} (app-internal adapter, 563 lines, never published in any release; no package.json of its own upstream, so it is vendored as a partial-package source directory mirroring upstream layout, not registered as a workspace and not imported anywhere — Step 1 decides its packaging when it consumes it).
• docs/VENDORING.md gains a "Provenance, ownership, and kill dates" table covering all 11 vendored paths with upstream repo/commit, patched-or-verbatim, why-not-published, owner, and a proposed kill date: an observable condition (e.g. "when @intx/mailbox@>=0.4.0 publishes") plus a hard backstop of 2027-03-07. Kill dates are proposals for operator ratification.
• No app wiring: no src/ (or packages/tests/evals/scripts) file imports any of the new trees; workspaces/overrides/dependencies registration only. Nothing was stopped: all six candidates' sources exist at the pin.

Verification

• bun run check — exit 0 (lint, typecheck, build, guard, full suite 6263 pass / 0 fail)
• bun test vendor/intx-mailbox vendor/intx-harness vendor/intx-mime — 259 pass / 0 fail
• Vendored copies verified pristine via git archive from the upstream clone at 0205b07b
• Branch CI is green on the head commit: typecheck, eslint, prettier, and build-and-test all pass
• History note: pushed commit 6f0296b2 has a 77-character subject, over the 72-character limit; left in history rather than rewritten on a pushed shared branch. This branch's subsequent subjects comply.

Fixes CL-7303

[linear-code]

CL-7303