fix: isolate Flow subprocesses from MCP stdin

[zt1901]

Problem

The MCP server owns stdin as its JSON-RPC transport, but FlowRunner.run() and FlowRunner.certify() currently pass that live stream to openadapt-flow. A child command that probes or reads stdin can block indefinitely or consume MCP protocol bytes.

Change

• launch both Flow subprocess paths with stdin=subprocess.DEVNULL
• extend the shared CLI stub to record stdin
• assert the isolation contract for both run and certify

Validation

• uv run --extra dev pytest tests/test_runner.py tests/test_bridge.py::test_certify_result_is_fixed_copy_unless_protected_export_enabled -q (32 passed)
• uv run --extra dev ruff check src/openadapt_agent/runner.py tests/conftest.py tests/test_runner.py tests/test_bridge.py
• git diff --check